MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 13
| SHA256 hash: | afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660 |
|---|---|
| SHA3-384 hash: | 3c54a4e10bef0b753dc811ba09454304928031aa64aea4de9fe18a7994d94ac20ff2bf86d5877b13e186f0c9739f426c |
| SHA1 hash: | a3fe343817dc817c091fb2b30b36600abfb062df |
| MD5 hash: | 5214e287e7509bb4940901996b496d4d |
| humanhash: | four-johnny-quiet-illinois |
| File name: | SecuriteInfo.com.Win32.MalwareX-gen.15133.26520 |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 1'783'808 bytes |
| First seen: | 2024-02-11 15:45:47 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:QLBCNLuUJ8CMxio71kiSyvrZzUeQmu1+sbkGsN9zZ4uQMWsUbMjCfxXmikVgiK:Q94Lu1C6ryhwrFQmuXuFdHWjIjCgzVz |
| TLSH | T11E8523047168915EDA33CE7D99A5C97331A69E01ECC08A20EDE97FFB7676B467082F04 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| dhash icon | b271c49696dc71b2 (1 x RedLineStealer, 1 x UmbralStealer) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe RedLineStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
303
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://github.com/CHUPAPIMUNYAYO/Minecraft-Ghost-Clients
Verdict:
Malicious activity
Analysis date:
2022-07-11 21:11:42 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
packed packed
Verdict:
Malicious
Labled as:
Lazy.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
60 / 100
Signature
.NET source code contains potential unpacker
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Score:
93%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Generic
Status:
Malicious
First seen:
2021-03-26 07:59:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
18 of 38 (47.37%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Loads dropped DLL
Unpacked files
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Detections:
INDICATOR_EXE_Packed_AgileDotNet
SH256 hash:
f47186f92a5e156e7b3be0e777045a63fd39ee626d3bd56171d049106cb78ce2
MD5 hash:
90b0d77a49738f3093354b2a10ad5c8e
SHA1 hash:
23eaa5b99b203d428da8e33439f28906b6ed4006
Detections:
INDICATOR_EXE_Packed_AgileDotNet
SH256 hash:
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
MD5 hash:
5214e287e7509bb4940901996b496d4d
SHA1 hash:
a3fe343817dc817c091fb2b30b36600abfb062df
Detections:
INDICATOR_EXE_Packed_Fody
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_EXE_Packed_Fody |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables manipulated with Fody |
| Rule name: | INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu |
|---|---|
| Author: | ditekSHen |
| Description: | Detect executables with stomped PE compilation timestamp that is greater than local current time |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.