MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2b2f7b0df6afbfff18ac81be6bb28c5866033789f999ea7c8c3104a9c1e1d86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2b2f7b0df6afbfff18ac81be6bb28c5866033789f999ea7c8c3104a9c1e1d86
SHA3-384 hash: 0f8be7107ce3a692ec06201c3c1865c9cc77df0765a06cdd2c8b3732ca8603f281ab2ec95a27be8de38319f962262be3
SHA1 hash: 4dcb54a178e42edaec609014990ceee76e31917c
MD5 hash: 6377ca1c9c8c75687e5364d2c066ca39
humanhash: massachusetts-blue-montana-fix
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:299'008 bytes
First seen:2023-12-05 07:33:48 UTC
Last seen:2023-12-05 11:15:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b610b1ff2dfb4b84acc0b3fb1474f9f2 (10 x RedLineStealer, 2 x Vidar, 1 x LummaStealer)
ssdeep 6144:Ud1MR408ajawvs9TqeiQcw/FiXUXp/GFLsz7rFEvJiq:o1MRx8aNvsxq41XV8Lsz7rFEv
TLSH T1635406D87360E028CE2A98F575FAC1539DAEC5EDA134CE5BCA1912677BD40B41B70C8B
TrID 45.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.3% (.EXE) OS/2 Executable (generic) (2029/13)
18.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.0% (.EXE) DOS Executable Generic (2000/1)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from https://serviss.com.mx/autorun.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
397
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/462581/
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.18899.14662.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Gathering data
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/656ed26c3f60a8103489046a/reports/7f741a55-0bfa-4d2c-aad8-0cb9818d1f17/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/c2b2f7b0df6afbfff18ac81be6bb28c5866033789f999ea7c8c3104a9c1e1d86
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e503407c-4489-4a98-82d1-7b42ec70a810
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1353808
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c2b2f7b0df6afbfff18ac81be6bb28c5866033789f999ea7c8c3104a9c1e1d86
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2b2f7b0df6afbfff18ac81be6bb28c5866033789f999ea7c8c3104a9c1e1d86/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-12-05 07:34:05 UTC
File Type:
PE (Exe)
AV detection:
13 of 23 (56.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ykzppmg7nl5774mkzan6noziywdgam3yt6mz5j6iymievha6dwda._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/231205-jd367sab89/
Unpacked files
SH256 hash:
5cf44441e6a07804455bfbbe39afec3e34e4f0250204f8a04a1dff690e33d006
MD5 hash:
424a81acd400bfc12cb7e00cc33604dc
SHA1 hash:
97054f8ec1b94da908ff0bf6a9f5ac1d06d7116e
Detections:
redline
Create hunting rule
INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Link:
https://www.unpac.me/results/936a545b-7576-46b9-8d05-63cb0ff71bf2/
Parent samples :
ae686f55ab125bdb9989ddec44478c68c481f1a3982b858862db9dfa79643ef2
ab6b120857e29436e54c4ae4acfd092fe86fc6632decf1dd99d1c5662573804a
61041f4751518a445e2300c2fd199ec4ccf147dee53c432fbb9e8b36558208bc
c2b2f7b0df6afbfff18ac81be6bb28c5866033789f999ea7c8c3104a9c1e1d86
SH256 hash:
c2b2f7b0df6afbfff18ac81be6bb28c5866033789f999ea7c8c3104a9c1e1d86
MD5 hash:
6377ca1c9c8c75687e5364d2c066ca39
SHA1 hash:
4dcb54a178e42edaec609014990ceee76e31917c
Link:
https://www.unpac.me/results/936a545b-7576-46b9-8d05-63cb0ff71bf2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2b2f7b0df6afbfff18ac81be6bb28c5866033789f999ea7c8c3104a9c1e1d86

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2737671/
Cape
Cape
https://www.capesandbox.com/analysis/462581/

Comments