MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bafabb4721aa53307b5339d148014334d98976134a6896471577878bc5732dda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 8
| SHA256 hash: | bafabb4721aa53307b5339d148014334d98976134a6896471577878bc5732dda |
|---|---|
| SHA3-384 hash: | 7f115e317dcc979e88b7aa5d689ef8b7c88266f55df8345caa198e053f357ff2ba1b948e5225c515a3b2d9fe9b299894 |
| SHA1 hash: | 09cbe64ec6a5dec39e6d1c743d8e619d06c77c05 |
| MD5 hash: | 953fcf7b3ffbc73f4b33786d0f113664 |
| humanhash: | glucose-zebra-single-dakota |
| File name: | 953fcf7b3ffbc73f4b33786d0f113664 |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 168'960 bytes |
| First seen: | 2021-10-13 21:34:56 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 2122adc88eb6e103fbc7dbe6426ed12d (1 x ArkeiStealer, 1 x DanaBot, 1 x RedLineStealer) |
| ssdeep | 3072:PVJryuQJJMQvCBehTu3EPoS9D98aShyuyjh34Oz:jryzkGCEPVx98aCAh34O |
| Threatray | 74 similar samples on MalwareBazaar |
| TLSH | T18AF3AE20F2D1C4BEC4A716709C658BF25AFBB821567492CB77A8377E1F603C05A7A316 |
| File icon (PE): |  |
| dhash icon | 81bcdcac9cccb48c (4 x RaccoonStealer, 3 x Smoke Loader, 3 x RedLineStealer) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe RedLineStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
316
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
953fcf7b3ffbc73f4b33786d0f113664
Verdict:
No threats detected
Analysis date:
2021-10-13 21:53:56 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
phis.evad
Score:
80 / 100
Signature
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Modifies Chrome's extension installation force list
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Azorult
Status:
Malicious
First seen:
2021-10-12 21:39:46 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 64 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
f147472617d014e1ac9640069046ce091472b2528414f5fd1deb68bec87e6281
MD5 hash:
36f7b8ac26f4982057b43ce2592cee19
SHA1 hash:
2aae67f854dc3a210cf55c6062f4e8b9934676b7
SH256 hash:
bafabb4721aa53307b5339d148014334d98976134a6896471577878bc5732dda
MD5 hash:
953fcf7b3ffbc73f4b33786d0f113664
SHA1 hash:
09cbe64ec6a5dec39e6d1c743d8e619d06c77c05
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.