MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad8dbe0cb61579319b50c46763275091fe65a8a381860c00ee44b34c5c0d524f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	ad8dbe0cb61579319b50c46763275091fe65a8a381860c00ee44b34c5c0d524f
SHA3-384 hash:	59238c8d3f90f0baededb1966fa85970aafec18f549dc408d994281b3c37f227a50331cad3c79ef44127b639d7dd4850
SHA1 hash:	775f0d34cecaea22dd98967b0f40f5c5cd66eea6
MD5 hash:	0288e103bd6cb92242aafa1cdce1704d
humanhash:	lima-victor-nine-bluebird
File name:	0288e103bd6cb92242aafa1cdce1704d.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	626'688 bytes
First seen:	2021-07-05 06:49:16 UTC
Last seen:	2021-07-05 07:54:35 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	31bc5b00e4fb196a092d39676ddbafcc (5 x RedLineStealer, 1 x CryptBot, 1 x TeamBot)
ssdeep	12288:+5WETb29afs6AUEXjh1VQKIblZ+OfnVc7pz:+FTeafwRl1ibfVcFz
Threatray	450 similar samples on MalwareBazaar
TLSH	45D4127639D0D032C093A471193AD2217ABEA432AA6DD9137F4503BF6F707C29E7626D
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

139

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

abfbaac02ba1758a17b251595e0a6740.exe

Verdict:

Malicious activity

Analysis date:

2021-07-05 01:32:21 UTC

Tags:

trojan stealer vidar loader evasion

Link:

https://app.any.run/tasks/9346d82e-cb3b-4398-90d1-2c969982c980

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLineDropperAHK

Link:

https://www.capesandbox.com/analysis/169690/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.46577710.30672.6198.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d33c37bb-71b6-4698-bcc7-5054cca3cc44

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/811727

Signature

Contains functionality to register a low level keyboard hook

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample or dropped binary is a compiled AutoHotkey binary

Yara detected Evader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ad8dbe0cb61579319b50c46763275091fe65a8a381860c00ee44b34c5c0d524f/

Threat name:

Win32.Trojan.RedLineStealer

Status:

Malicious

First seen:

2021-07-04 20:41:40 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 46 (58.70%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vwg34dfwcv4tdg2qyrtwgj2qsh7glkfdqgdayahoiszuyxankjhq._file

Verdict:

unknown

RedLineStealer

15228a297d2cbbed2e933f386e38498127e6c3bed96f40dc22497eb22c1e61b1

RedLineStealer

321df14ebddd1db4c4e91180ba3640dbb9e4a01b53244c6d176faeed6a62e6e9

RedLineStealer

5342ae888cfa86f63f7fc07cfc613871e323106764d2b5c495aa1946800e49bd

RedLineStealer

57016c84e1c008db532f1c977fe608a767cdfc4a19f8619cbfdd82fe82a2aeae

RedLineStealer

7341c40c1693ae8350ec3eb83cce1d9e0744340b3dde2241e146b410f54c191b

RedLineStealer

90823e9bf099b873263241a2a7c3435b85fe6480ecb4fff4da9563ba95e7b31e

RedLineStealer

ebed275eba9f8eddb2242c93732b7a213ede149bd79a792de9d6f8dda6d7f3a3

RedLineStealer

ed3f452a9fed41f5d3dfb528d6c05a53298b559775eeec46eda50ad42a714b28

RedLineStealer

f6cafcfe7c87df305fc789e6ed6059b3e4de7c2e0001e800383a941180f9cc98

RedLineStealer

+ 440 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/210705-k3bhx8r536/

Behaviour

Checks processor information in registry

Legitimate hosting services abused for malware hosting/C2

Unpacked files

SH256 hash:

d871e285d3833a7b44679a4a26137275e42333037da8cd891121f5dfc06c0caa

MD5 hash:

8b82a23501981d6a599e4c44acfe6d41

SHA1 hash:

407959a0486a11cbda5d85e1bd307f816d8ae5f4

Link:

https://www.unpac.me/results/8686ed23-99cc-4b7e-b990-9fbde099d5e3/

SH256 hash:

ad8dbe0cb61579319b50c46763275091fe65a8a381860c00ee44b34c5c0d524f

MD5 hash:

0288e103bd6cb92242aafa1cdce1704d

SHA1 hash:

775f0d34cecaea22dd98967b0f40f5c5cd66eea6

Link:

https://www.unpac.me/results/8686ed23-99cc-4b7e-b990-9fbde099d5e3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ad8dbe0cb61579319b50c46763275091fe65a8a381860c00ee44b34c5c0d524f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_AHK_Downloader Create hunting rule
Author:	ditekSHen
Description:	Detects AutoHotKey binaries acting as second stage droppers

Rule name:	MALWARE_Win_RedLineDropperAHK Create hunting rule
Author:	ditekSHen
Description:	Detects AutoIt/AutoHotKey executables dropping RedLine infostealer