MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4dc1bf741e4b2e3874bbac1375c7a52225ac9aa0e0b71d9856546fbabd49213. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	b4dc1bf741e4b2e3874bbac1375c7a52225ac9aa0e0b71d9856546fbabd49213
SHA3-384 hash:	e68dbd4fc00e631ce00f3e4f932bd274a35544e765cd2c29f2ebec6f7ef0f07caa9cb12ec5b518da1b8948530b69c027
SHA1 hash:	456d6c682117bad84f04492467d93e1ba2b75b2b
MD5 hash:	80f8dcebe70cc447debbdc03caa9d6cf
humanhash:	kentucky-white-queen-oklahoma
File name:	80f8dcebe70cc447debbdc03caa9d6cf.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	693'760 bytes
First seen:	2021-10-08 04:50:00 UTC
Last seen:	2021-10-08 06:10:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	54bf62ec6910c4bfd61455c421ef149b (4 x RedLineStealer, 3 x RaccoonStealer, 3 x ArkeiStealer)
ssdeep	12288:GowrcXmlpYnUI1lelOAtiVPGl/hu1lCKxh8f7v:/wrc2sUfAAtidGmC17
Threatray	762 similar samples on MalwareBazaar
TLSH	T1FBE4F201B7B0C035F5B761F45A7BA278B92F3AA1A72884CF52D512EA5B34AD1EC70317
File icon (PE):
dhash icon	68e8e8e8aa66a499 (33 x RaccoonStealer, 14 x ArkeiStealer, 11 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

166

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

80f8dcebe70cc447debbdc03caa9d6cf.exe

Verdict:

Malicious activity

Analysis date:

2021-10-08 05:01:06 UTC

Tags:

evasion opendir

Link:

https://app.any.run/tasks/60b9b198-27b3-4c3b-849a-459faf863db6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLineDropperAHK

Link:

https://www.capesandbox.com/analysis/196022/

Detection(s):

SecuriteInfo.com.Trojan.DownLoad4.14406.29594.12971.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Creating a file in the %AppData% subdirectories

Launching a process

Creating a file in the Windows subdirectories

Deleting a recently created file

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/615fce00b95458900cdee15f/reports/0d4a250f-1491-49ba-a6c4-6553359fbfb4/overview

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f8714b23-602e-4af3-896b-3a39f19bcf69

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spre.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/866847

Signature

Contains functionality to register a low level keyboard hook

Creates HTML files with .exe extension (expired dropper behavior)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample or dropped binary is a compiled AutoHotkey binary

Yara detected Autohotkey Downloader Generic

Yara detected Evader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b4dc1bf741e4b2e3874bbac1375c7a52225ac9aa0e0b71d9856546fbabd49213/

Threat name:

Win32.Trojan.Raccoon

Status:

Malicious

First seen:

2021-10-08 04:50:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 28 (92.86%)

Threat level:

5/5

Verdict:

malicious

RedLineStealer

5ef5f8a5b159ff8bb0e899dc25f57293c7bca8f5ac5d644c49a6c92be1b21405

RedLineStealer

64eb44d654d183e8f4736bd96c1b487e0f7b39243fe1016fe5d108b6c3f98bad

RedLineStealer

7ca74aa1face110ab7e965a83665bdd0d05ae25512a0376a14d1957df68eb4a9

RedLineStealer

aac3cb0f57c021124e3dcaab730faaf8771f9cd0af9f39a5b41ba493a7f2ccbe

RedLineStealer

c44003fda460e601c0d058ae28985cc89eff6db2bb3f14c033ee44a6f26f33b4

RedLineStealer

d1be37152c2045f831a7c907c2a35fc604158ee7ecb871bbdac1e0300b3bfcaf

RedLineStealer

+ 752 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/211008-ff96radcc5/

Behaviour

Checks processor information in registry

Enumerates physical storage devices

Legitimate hosting services abused for malware hosting/C2

Unpacked files

SH256 hash:

5cc1befdb54d051d6008c79eb774fa9b309fe2843ec77488f2d4d02c4881f85e

MD5 hash:

78c0685902e8d391df29739e36863e11

SHA1 hash:

ac406b4f33f4b4ee3fc7dd3c646857f2a660475c

Link:

https://www.unpac.me/results/5525ef00-4edb-4890-a5c2-ef2b663b3f26/

SH256 hash:

b4dc1bf741e4b2e3874bbac1375c7a52225ac9aa0e0b71d9856546fbabd49213

MD5 hash:

80f8dcebe70cc447debbdc03caa9d6cf

SHA1 hash:

456d6c682117bad84f04492467d93e1ba2b75b2b

Link:

https://www.unpac.me/results/5525ef00-4edb-4890-a5c2-ef2b663b3f26/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b4dc1bf741e4b2e3874bbac1375c7a52225ac9aa0e0b71d9856546fbabd49213

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_AHK_Downloader Create hunting rule
Author:	ditekSHen
Description:	Detects AutoHotKey binaries acting as second stage droppers

Rule name:	MALWARE_Win_RedLineDropperAHK Create hunting rule
Author:	ditekSHen
Description:	Detects AutoIt/AutoHotKey executables dropping RedLine infostealer