MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae691d1cc50248eaf2e482fe9f7e80c8c5d6a447bf49d34088681a36a057abe8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae691d1cc50248eaf2e482fe9f7e80c8c5d6a447bf49d34088681a36a057abe8
SHA3-384 hash: bcc6c41585caf498485927ccfea73e9ed0be12edf7e42b6b2b04af7be6b5cf3a2bc60bf6cec42c32c2425a30e3e3081d
SHA1 hash: db6edf2787d48568c57dbcbf713355b7eb9d9878
MD5 hash: 5c576b98dbcd3e97d636057096759fe8
humanhash: oklahoma-seventeen-muppet-leopard
File name:80898511.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:479'232 bytes
First seen:2022-03-23 16:25:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ee7c4bb4ec9bce22f4acc67576d77beb (1 x Smoke Loader, 1 x RedLineStealer)
ssdeep 6144:4pgpM/JnvrQOqeR96/six9zBatb8aviFwmiE0FsawPfkuMmDzAiS:y5/JnDPqeb6B9zcmondFFKfkub
Threatray 4'955 similar samples on MalwareBazaar
TLSH T150A4C010B690C035F1F712F8567AA7A9A53E7EE16B2495CB53D52AEE17386E0EC30307
File icon (PE):PE icon
dhash icon 167349e173220ec8 (1 x RedLineStealer)
Reporter adm1n_usa32
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
223
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/256724/
Detection(s):
Win.Dropper.Generickdz-9939781-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/10933/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
CPUID_Instruction
EvasionGetTickCount
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/623b4a3f0cd58dbd92e04640/reports/3a966a0c-407d-44cf-88a4-a9131563e657/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/962935
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ae691d1cc50248eaf2e482fe9f7e80c8c5d6a447bf49d34088681a36a057abe8/
Threat name:
Win32.Trojan.RaccoonStealer
Create hunting rule
Status:
Malicious
First seen:
2022-03-23 16:26:26 UTC
File Type:
PE (Exe)
Extracted files:
13
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vzur2hgfajeov4xeql7j67uazdc5njchx5e5gqeinandnicxvpua._file
Verdict:
malicious
Similar samples:
02a1be5f6bac2f03f8dc06a3b94f346ab67f18b70703b80d91ca47478f6d8c5f
RedLineStealer
16e387601a084c5712d0f9fc8dc4a09a894521c95a20a7596b68fb6088682613
RedLineStealer
2e6a515f6f0f4c6afeee0504513de753828975c0a0ee4630ccd4474f0ca8e002
RedLineStealer
68a03036f681dd983cce0963051c546806db97d728baaf14b969432229c3b4f4
RedLineStealer
bfdcfeecf5b9596257de7aa327baedeac2ab806435c69eefba75479227588bcc
RedLineStealer
c616122ddb20e0572157aad9871b38b1e395187e9a3d6127d2dd17371194527f
RedLineStealer
+ 4'945 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:buildm infostealer
Link:
https://tria.ge/reports/220323-txkjbadcgr/
Behaviour
Suspicious use of AdjustPrivilegeToken
RedLine
RedLine Payload
Malware Config
C2 Extraction:
207.32.218.47:48899
Unpacked files
SH256 hash:
1cd085b0a9c2841b21970b50b5a9e8b6eaa6cb81407c1bfcba9daff90ea15522
MD5 hash:
6169b2ce5edf83dc6857389ada4bdd17
SHA1 hash:
f64cccc99432a4ba462b5e534424eb38ad44d69f
Link:
https://www.unpac.me/results/8901062b-2de4-4e18-bc2b-df2708abf567/
SH256 hash:
85c67e3f4541ef9a82c5d2e88ce0b9d099a968cebf44a9e5a8f4827ccb0fb4e7
MD5 hash:
1aeb6ac29090be8b457bcf0f20eae747
SHA1 hash:
7c64e154f4ca0a154f8be13d61765925ac99d2b4
Link:
https://www.unpac.me/results/8901062b-2de4-4e18-bc2b-df2708abf567/
SH256 hash:
74a6ce9aa94a563eabc6275371e5730d7bd0106b29c77e7164e2149e38a92052
MD5 hash:
65697f3623e29b063d27ec17a1212092
SHA1 hash:
1e603b1a29822734cd941ef9881e6f130e4b0dcf
Link:
https://www.unpac.me/results/8901062b-2de4-4e18-bc2b-df2708abf567/
SH256 hash:
ae691d1cc50248eaf2e482fe9f7e80c8c5d6a447bf49d34088681a36a057abe8
MD5 hash:
5c576b98dbcd3e97d636057096759fe8
SHA1 hash:
db6edf2787d48568c57dbcbf713355b7eb9d9878
Link:
https://www.unpac.me/results/8901062b-2de4-4e18-bc2b-df2708abf567/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ae691d1cc502/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ae691d1cc50248eaf2e482fe9f7e80c8c5d6a447bf49d34088681a36a057abe8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/256724/

Comments