MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a072b6112f5ea82e5914c1f3314aafc92b234f5a252eda19f889581adb4e6a65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 11
| SHA256 hash: | a072b6112f5ea82e5914c1f3314aafc92b234f5a252eda19f889581adb4e6a65 |
|---|---|
| SHA3-384 hash: | 3376db72b3766cb7721adfd169983aa9a209b449e6780c7b3ccf1b09e3aea1fa355972c63aa7e15412ce98845f893a77 |
| SHA1 hash: | 410c2586b4b181976a93534deefe6d46aa58bfd1 |
| MD5 hash: | 43eaf2e2226cd28ba7142ddfdd47356e |
| humanhash: | mango-illinois-stream-oven |
| File name: | a072b6112f5ea82e5914c1f3314aafc92b234f5a252ed.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 1'761'936 bytes |
| First seen: | 2022-05-24 13:32:28 UTC |
| Last seen: | 2022-05-24 14:45:46 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5a594319a0d69dbc452e748bcf05892e (21 x ParallaxRAT, 20 x Gh0stRAT, 15 x NetSupport) |
| ssdeep | 24576:t4nXubIQGyxbPV0db26WxQqKdQsv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdOa:tqe3f67PRSffPMWrQ0Zk7 |
| Threatray | 251 similar samples on MalwareBazaar |
| TLSH | T1D585C03FF268A53EC45E1B3245B39250997BBA60A81A8C1F07FC384DCF765601E3B656 |
| TrID | 49.7% (.EXE) Inno Setup installer (109740/4/30) 19.5% (.EXE) InstallShield setup (43053/19/16) 18.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 4.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.0% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 5050d270cccc82ae (109 x Adware.Generic, 43 x LummaStealer, 42 x OffLoader) |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 85.239.53.70:80 | https://threatfox.abuse.ch/ioc/630038/ |
Intelligence
File Origin
# of uploads :
2
# of downloads :
317
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
ID:
1
File name:
PC_En-1653378944_setup_malware_analyze.exe
Verdict:
Malicious activity
Analysis date:
2022-05-24 08:09:52 UTC
Tags:
loader stealer trojan rat redline hiloti evasion opendir systembc
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Launching a process
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
DNS request
Sending an HTTP GET request
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Modifying a system file
Creating a file in the Windows subdirectories
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckNumberOfProcessor
CheckCmdLine
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
control.exe expand.exe overlay packed setupapi.dll shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
92 / 100
Signature
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Performs DNS TXT record lookups
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Threat name:
Win32.Downloader.Satacom
Status:
Malicious
First seen:
2022-05-23 11:38:30 UTC
File Type:
PE (Exe)
AV detection:
14 of 26 (53.85%)
Threat level:
3/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 241 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Unpacked files
SH256 hash:
a7e37f5314834b163fa21557e61c13c0f202fd64d3c0e46e6c90d2d02e033aec
MD5 hash:
6faec01bf7a3d7f5c5dee2e6e3143a58
SHA1 hash:
603a36f817cab5574e58ab279379e5c112e5fb37
SH256 hash:
724b85f1f97ebaa793f4e0bba29337657cd4393c04948cfae1ddc8613a3e319e
MD5 hash:
892965cf131bc5a238d8c7a190718c80
SHA1 hash:
dde8dde7d656a8ce413cb4cb8b6b46afe3a6eabb
SH256 hash:
a072b6112f5ea82e5914c1f3314aafc92b234f5a252eda19f889581adb4e6a65
MD5 hash:
43eaf2e2226cd28ba7142ddfdd47356e
SHA1 hash:
410c2586b4b181976a93534deefe6d46aa58bfd1
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.