MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ab8f2be8142a247fdd1e03fb81099de328f8e296a0a4eaf918a8c2a6eca4588. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 1 File information Comments

SHA256 hash:	8ab8f2be8142a247fdd1e03fb81099de328f8e296a0a4eaf918a8c2a6eca4588
SHA3-384 hash:	8ec9a9cd0f38d73910dfeee9649fb6b35a4f18bd6fc99ad4fd322f692da4ae8fbe23d5c163f1950871b1dc0d296ff1dc
SHA1 hash:	363dccb81bc9ba97aa1a8a106606021829424f64
MD5 hash:	84cc814f3d7285491de92abbda184c10
humanhash:	hamper-burger-nine-steak
File name:	84cc814f3d7285491de92abbda184c10.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	419'840 bytes
First seen:	2021-10-25 07:22:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	42a85e96dd3802acf3c449e9535a10b5 (3 x RedLineStealer, 1 x RaccoonStealer)
ssdeep	6144:k4gp+KO3kDXyTH80E0QJhbk0FaxaAgNo2ZhnwKdbdKAQ1vmoIJNSxxm:kfp+KPiDf0FdhB/wKdbdKAQ4oT
Threatray	1'258 similar samples on MalwareBazaar
TLSH	T16D949E00AB90C035F5F312F489B993A8B52E7EE15B2450CBA3E51AEE57356E1EC3135B
File icon (PE):
dhash icon	aad8ac9cc6a68ea0 (2 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

n/a

Vendor Threat Intelligence

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/199791/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6176a306a9d585e6d53717da/reports/f4bb9cb3-46bb-418c-8221-462ee1472538/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f4e36ae2-2ab7-4fed-a22b-8189480c5c8e

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/876040

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8ab8f2be8142a247fdd1e03fb81099de328f8e296a0a4eaf918a8c2a6eca4588/

Threat name:

Win32.Infostealer.Reline

Status:

Malicious

First seen:

2021-10-25 03:02:00 UTC

AV detection:

15 of 28 (53.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rk4pfpubikrep7or4a73qeez3yzi7drjnife5l4rrkgcu3wkiwea._file

Verdict:

malicious

RedLineStealer

09f5c996d550cd310ffb0d76c649de96109a7039440d41e476234d52b8dc2f3a

RedLineStealer

1954eb49f231c2a70291889f5b12331953adf76f1e4179c87b7b9cd871079d28

RedLineStealer

6152b89328948e22cdaa7c340449bb172fbf4e919c05dd3ac84362ea7fec657d

RedLineStealer

93cab9c0bb921b19441630eaff516d547c8083dd1e2bd7b8b799ec282af5ef23

RedLineStealer

c03c8a4852301c1c54ed27ef130d0de4cdfb98584adef3dda2a096177016a18b

RedLineStealer

d0dda5dfd52eedeb0c31cc69428a488f7af8f66e6c3a736ff88c6ea1c8ebed35

RedLineStealer

+ 1'248 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:uts infostealer

Link:

https://tria.ge/reports/211025-h7tdesfgc3/

Behaviour

RedLine

RedLine Payload

Malware Config

C2 Extraction:

45.9.20.182:52236

Unpacked files

SH256 hash:

8c364da8bad418bfc1448d7d8d05309e63ddc342167281a7736aa75d7e9c7f92

MD5 hash:

74ccd2abb11fcd2cc3f541f81ad82fde

SHA1 hash:

686fcde0b0acfd22fd473509a045d91238207b5b

Link:

https://www.unpac.me/results/7d2d6419-25d8-428f-8b70-3d7c26219b20/

SH256 hash:

a50700d89fa1a3a12cf3d287afb63a7f1999b1c37a86c7cd2b21a594e96ded1b

MD5 hash:

053bc31056de5a1a94c23af1e370bcfc

SHA1 hash:

39578bf82bc9d7cea5b74b5a4afac3719c197634

Link:

https://www.unpac.me/results/7d2d6419-25d8-428f-8b70-3d7c26219b20/

SH256 hash:

c47685766f0eabaf6c5966dac220c6b960df891964a0166e2bdf1e39e43fb870

MD5 hash:

a481d5055582c48946e5d213ad7aa5ce

SHA1 hash:

2dc9cc2fa4de87d488aab8e9b4f4629bfc3e732f

Link:

https://www.unpac.me/results/7d2d6419-25d8-428f-8b70-3d7c26219b20/

SH256 hash:

8ab8f2be8142a247fdd1e03fb81099de328f8e296a0a4eaf918a8c2a6eca4588

MD5 hash:

84cc814f3d7285491de92abbda184c10

SHA1 hash:

363dccb81bc9ba97aa1a8a106606021829424f64

Link:

https://www.unpac.me/results/7d2d6419-25d8-428f-8b70-3d7c26219b20/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/8ab8f2be8142/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8ab8f2be8142a247fdd1e03fb81099de328f8e296a0a4eaf918a8c2a6eca4588

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.