MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf5b770fa754d54c658f859e85873708b92b757179eb761629d0ea83f6d5f9cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bf5b770fa754d54c658f859e85873708b92b757179eb761629d0ea83f6d5f9cb
SHA3-384 hash:	c554906379f4b49f7f716c791eb7bc60fffac343fb4fa2f265bfef94260a611ffed8cab7027552803ac5454f2b0b18f2
SHA1 hash:	80977ef96f1614b91366eb0ce7b3e8639a76338e
MD5 hash:	def9168d187f736cd5f73d0af24e6474
humanhash:	winner-social-indigo-maine
File name:	def9168d187f736cd5f73d0af24e6474.exe
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	2'342'400 bytes
First seen:	2023-04-06 15:00:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep	49152:UnZoG2Q3waP1168eYIWE6EY/pZl9LaFNLnf27gYa5pu+0L:PG2QgaPb68eYI/Pv0L
Threatray	260 similar samples on MalwareBazaar
TLSH	T197B53307F5C10473F935633198FD46C70639BDD0AEB6421B3B9A924DBCB0940A67AB7A
TrID	70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 3.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):
dhash icon	f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

271

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

def9168d187f736cd5f73d0af24e6474.exe

Verdict:

Malicious activity

Analysis date:

2023-04-06 15:02:10 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3d8ea6e0-0c5d-43d2-8eba-8f52a2db5a46

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/380665/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.29170.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Running batch commands

Creating a process with a hidden window

Creating a process from a recently created file

Сreating synchronization primitives

DNS request

Sending a UDP request

Sending a custom TCP request

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/76830/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

EvasionQueryPerformanceCounter

EvasionGetTickCount

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/bf5b770fa754d54c658f859e85873708b92b757179eb761629d0ea83f6d5f9cb

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/6426ec1f-cdd5-458e-aa8d-8bbb13d8a48b

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1209773

Signature

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bf5b770fa754d54c658f859e85873708b92b757179eb761629d0ea83f6d5f9cb/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x5nxod5hktkuyzmpqwpilbzxbc4sw5lrphvxmfrj2dvih5wv7hfq._file

Threatray suspicious

Verdict:

suspicious

Similar samples:

155c76210badfc3ef9bfc764a7ab3cb9702f76c9d63351a213f61d44abbf0b4f

RedLineStealer

18055486aef1f706a69134be283fffdad9c49f5ffecda5d869e74c2ae882cd6c

RedLineStealer

242467ea19694c0e6cd76dcff901f5af6a309c2c999971b1dc4cd9bad253ea19

RedLineStealer

38eab87af431cba1bbec5ca10fa9502a0b110c1baf6372f5c271584b02eb2857

RedLineStealer

4b4eb8ac2362a026112033f822d2b84d5da55e18c922790d8dd2a905fdaad8cb

RedLineStealer

5920894ae997b61f27b53c9f6e598df5f928acb11a5dc09f4fa0627747f1312d

RedLineStealer

8b3915b52f03e8a23c59146ceb7f9d50b0a59e466c2c4e1f3ac3e7875106350e

RedLineStealer

ae54c18727715192eb0e5160f7ef9f7ff2382a517679a6c84e1136280ed11aee

RedLineStealer

+ 250 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

persistence

Link:

https://tria.ge/reports/230406-sdwa2afd8t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

Adds Run key to start application

Executes dropped EXE

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

752a10af4580e660094c52fc12f9adf1aeb6540da428f84bb49133527fa6e619

MD5 hash:

2d9726ca86c93854142e9404bb5c948b

SHA1 hash:

7a944cdf7d3be5d04e963c6aa3cbd335dcab813d

Link:

https://www.unpac.me/results/2f79788b-2dc6-4a44-829e-64931ec0fa13/

SH256 hash:

bf5b770fa754d54c658f859e85873708b92b757179eb761629d0ea83f6d5f9cb

MD5 hash:

def9168d187f736cd5f73d0af24e6474

SHA1 hash:

80977ef96f1614b91366eb0ce7b3e8639a76338e

Link:

https://www.unpac.me/results/2f79788b-2dc6-4a44-829e-64931ec0fa13/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bf5b770fa754d54c658f859e85873708b92b757179eb761629d0ea83f6d5f9cb

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/380665/