MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5d8deb0a6da4352ded02c6a51c10efae2b030518247713ecb28274123b76fb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5d8deb0a6da4352ded02c6a51c10efae2b030518247713ecb28274123b76fb8
SHA3-384 hash: 51fe2cfdd53c35fe9553717bf0e090a6f1a3e26be5590c2ad9a9d66f6432c9aa767d9d66293393033ea48e836feeb36a
SHA1 hash: adce7ca8c1860e513fb70bcc384237dae4bc9d26
MD5 hash: 9c83827f217c34b764ff9d6899ccc78e
humanhash: autumn-connecticut-river-single
File name:3cff9952-9eab-45a5-bdc8-671fd9a6c226.bat
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:89'541 bytes
First seen:2023-01-25 17:45:19 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 1536:InQJ5JEXld1MZIwZunelIIYFOvevv3mbxS9Q0dCvp+v+BIJjqST:IQJbEXz7eBFevvQxSSU+7ST
Threatray 2'927 similar samples on MalwareBazaar
TLSH T16393F12FE677B8788ADCE548F212C82D77BF9D22816103ED49431AC98A53F7CAF60551
Reporter 0xToxin
Tags:bat RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
IL IL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3cff9952-9eab-45a5-bdc8-671fd9a6c226.bat
Verdict:
Malicious activity
Analysis date:
2023-01-25 17:45:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/95bf7d15-c900-4a56-be0f-1fdc7caf361b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/356792/
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
50%
Link:
https://www.filescan.io/uploads/63d16adb2b351a3d0ea8c38c/reports/490998d7-713a-4aa9-bcac-ec2cc04bed9e/overview
Result
Verdict:
UNKNOWN
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1158929
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Malicious sample detected (through community Yara rule)
Renames powershell.exe to bypass HIPS
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5d8deb0a6da4352ded02c6a51c10efae2b030518247713ecb28274123b76fb8/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2xmn5mfg3jbvfxwqfrvfdqio7lrlamcrqjdxcpwlfatuci5xn64a._file
Verdict:
malicious
Similar samples:
760de76033fc771ea58714885fc528d0b14ed5ef45f2080971687cc182883846
RedLineStealer
764250ddf94b90441193fe1c29754f231e0868d1878fdf3150e5744dd8d8c378
RedLineStealer
7f9558b222b78098c76f84c190fb28848c2f8e2e89cabfd7eb3ba83a6160c96d
RedLineStealer
80c1568ef979e0d9881fa33ee69c3f8c15caa924acd4df9e4c951a7047577caa
RedLineStealer
8df28341644c2139c9d9dfb6231169c70fdb5a18daf628bac6307503f4d0b80f
RedLineStealer
bd45e50b3ec1e76b4cc8c018131921f5237a356b1dcbc9ec69fdf9788edbea58
RedLineStealer
+ 2'917 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/230125-wb98yshc73/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Deletes itself
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d5d8deb0a6da4352ded02c6a51c10efae2b030518247713ecb28274123b76fb8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/356792/

Comments