MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d668ad781ee9b81de4e5da26889308f4f7c496f68cf9001862b7a9d1b5e16cf3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 17


Intelligence 17 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d668ad781ee9b81de4e5da26889308f4f7c496f68cf9001862b7a9d1b5e16cf3
SHA3-384 hash: 45a637d1095c709e9682d62c01bd20c7b9b24928a3196b3d3dd5804d0fbd3f07c38a210fc5ce006553b140dd58cdf917
SHA1 hash: bd47410e784917acada783ddbe6bdd2aa7606ae9
MD5 hash: 7b1c01344bf970909296e1552781f405
humanhash: echo-bravo-emma-iowa
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:325'632 bytes
First seen:2023-07-11 06:04:45 UTC
Last seen:2023-07-11 06:34:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 267ebac2da81baae2c32ae16b7c3027a (4 x RedLineStealer, 2 x Smoke Loader, 2 x DCRat)
ssdeep 6144:0FQo8sIo9s2iq+P8d3A3iXlBAbu8ierklW6YvCCWx:0V8ls3iqsOXlJ8i+zRW
Threatray 106 similar samples on MalwareBazaar
TLSH T19C64BF0272A0BC61F5267F314E7DE7A8765EFD918F1823DB26187A2F09701E2857271B
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 000028a248245000 (1 x RedLineStealer)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from http://194.169.175.136:3002/

Intelligence

File Origin
# of uploads :
2
# of downloads :
291
Origin country :
US US
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
https://www.evarlic.com/wp-content/download/File_pass1234.7z
Verdict:
Malicious activity
Analysis date:
2023-07-11 05:55:55 UTC
Tags:
privateloader evasion opendir rat redline fabookie stealer loader smoke trojan amadey
Link:
https://app.any.run/tasks/fccd4880-6888-40fd-afac-13f3a5c07eca

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/414853/
Detection(s):
SecuriteInfo.com.Win32.DropperX-gen.27662.17936.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a window
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Launching a process
Launching the default Windows debugger (dwwin.exe)
Creating a process with a hidden window
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Adding an exclusion to Microsoft Defender
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/97098/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/64acf10f6e9f7019de9f1cc1/reports/54c626a2-8030-4c69-ac54-5673fb458b73/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/d668ad781ee9b81de4e5da26889308f4f7c496f68cf9001862b7a9d1b5e16cf3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b7d5ba28-0b85-41f5-8257-9662a96ccb22
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1270565
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates an autostart registry key pointing to binary in C:\Windows
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Schedule binary from dotnet directory
Snort IDS alert for network traffic
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1270565 Sample: file.exe Startdate: 11/07/2023 Architecture: WINDOWS Score: 100 74 Snort IDS alert for network traffic 2->74 76 Found malware configuration 2->76 78 Malicious sample detected (through community Yara rule) 2->78 80 7 other signatures 2->80 9 file.exe 15 7 2->9         started        14 AppLaunch.exe 2->14         started        16 MTA1.exe 2->16         started        18 2 other processes 2->18 process3 dnsIp4 62 147.135.165.22, 17748, 49702 OVHFR France 9->62 64 transfer.sh 144.76.136.153, 443, 49703, 49704 HETZNER-ASDE Germany 9->64 66 192.168.2.1 unknown unknown 9->66 52 C:\Users\user\AppData\Local\Temp\123123.exe, PE32 9->52 dropped 54 C:\Users\user\AppData\Local\Temp\123.exe, PE32 9->54 dropped 56 C:\Users\user\AppData\Local\...\file.exe.log, ASCII 9->56 dropped 94 Detected unpacking (changes PE section rights) 9->94 96 Detected unpacking (overwrites its own PE header) 9->96 98 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->98 100 2 other signatures 9->100 20 123123.exe 9->20         started        23 123.exe 14 64 9->23         started        file5 signatures6 process7 dnsIp8 82 Multi AV Scanner detection for dropped file 20->82 84 Writes to foreign memory regions 20->84 86 Allocates memory in foreign processes 20->86 88 Injects a PE file into a foreign processes 20->88 26 AppLaunch.exe 2 25 20->26         started        60 127.0.0.1 unknown unknown 23->60 90 Machine Learning detection for dropped file 23->90 92 Tries to harvest and steal browser information (history, passwords, etc) 23->92 31 chrome.exe 23->31         started        signatures9 process10 dnsIp11 70 ip-api.com 208.95.112.1, 49706, 80 TUT-ASUS United States 26->70 72 185.159.129.168, 49707, 80 ITOS-ASRU Russian Federation 26->72 58 C:\ProgramData\...\MTA1.exe, PE32 26->58 dropped 102 Suspicious powershell command line found 26->102 104 Creates an autostart registry key pointing to binary in C:\Windows 26->104 106 Uses schtasks.exe or at.exe to add and modify task schedules 26->106 108 Adds a directory exclusion to Windows Defender 26->108 33 powershell.exe 5 26->33         started        35 powershell.exe 5 26->35         started        37 schtasks.exe 1 26->37         started        39 schtasks.exe 26->39         started        41 chrome.exe 31->41         started        file12 signatures13 process14 dnsIp15 44 conhost.exe 33->44         started        46 conhost.exe 35->46         started        48 conhost.exe 37->48         started        50 conhost.exe 39->50         started        68 www.google.com 172.217.16.164, 443, 49712, 49713 GOOGLEUS United States 41->68 process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d668ad781ee9b81de4e5da26889308f4f7c496f68cf9001862b7a9d1b5e16cf3/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Suspicious
First seen:
2023-07-11 05:41:14 UTC
File Type:
PE (Exe)
Extracted files:
29
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2zuk26a65g4b3zhf3itireyi6t34jfxwrt4qagdcw6u5dnpbntzq._file
Verdict:
malicious
Similar samples:
02faea4481281e7d6e4bd48f06e969b6a9854d4746525af6ccae7a9748b49b95
RedLineStealer
1e34106fd70c84ab8a1a0b27425e2f6d53500fc48bbdc5b02041fb3459721473
RedLineStealer
2a5de2e7ec1dcc3e5b3c1a702b2efd8a60f928dfd641f152212647ed0c067218
RedLineStealer
39ff18916d45394e08dd2c2bd297f30671829ea91812af3c2a0a32b73d274e69
RedLineStealer
57641aef77ca6506c2ae922b35261631de04da377750a3494acbf7ca8951ac9b
RedLineStealer
5a6efc81f1a3e1c8266cbacdeaf04ee400dfcc3bc5998c6df13e68ad6f51cdc7
RedLineStealer
642fb7de5f7e3d2b625c2b1fe905e9bb26445460d0ed3904eb0ca6d708edc7aa
RedLineStealer
e6b5e4a15de0758793c71dd1b8ae4b6362a127148f70e25d8844156f114a86c0
RedLineStealer
f22e976a3cc892e7c21cf6e222d0cf2e0e6c0dc0f7b882c7ac8d365a1e3b4cd1
RedLineStealer
+ 96 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:logsdiller cloud (telegram: @logsdillabot) discovery infostealer persistence spyware stealer
Link:
https://tria.ge/reports/230711-gs6vjafe7s/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Downloads MZ/PE file
RedLine
Malware Config
C2 Extraction:
147.135.165.22:17748
Unpacked files
SH256 hash:
5dced280508f61d6b5a73eb478abb0f6d8165d239577d7d4bca2953019fbdd9a
MD5 hash:
d21174205d0df27c7ebaaec34b6d2e06
SHA1 hash:
efcd88425bc8580d5d881530bdd2abcc08f77715
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
SH256 hash:
d5264d0a59feabbab9333ff9af67ad8fa0281e88a3ece71710f116106f82346b
MD5 hash:
865d34909949f9bcee471da09ffe424c
SHA1 hash:
d2b47e54c1b5a747b59fead6c548a7465f5111c3
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
SH256 hash:
9fe6c8c1963ab952f1223e6286f61deb572910a858b697538901975030c58386
MD5 hash:
f8842e38a7d10714f0e4e61814c2d318
SHA1 hash:
bff1191f3197010f9536ed10a2f04edb31856bb4
Detections:
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
Parent samples :
933376e38f0ef413916ab8cd713b9b44b57f152c7d2e9ecb4af5b514012925c3
8044914fef05ba9c7505662b3bc53edfb8a376cd0383d5f81d35a3797a9339da
61b5dc04ec8d88a18260a3dfe42344ec5630c6af7204246429ccf48b0dedaf5c
249ff8adcaf0914424769055cc293a3114a071fd260073de2455d6f501971aa2
6b78dfce3fe9f54b8af722e912304dc97b681ff6d9ff3d77e3007b446443ba26
12ec771c6e24cc918e07de4b2a7b8be06b74bf1bfb2a0dbe0efac09e24bb9403
d668ad781ee9b81de4e5da26889308f4f7c496f68cf9001862b7a9d1b5e16cf3
8e98ea41349271538cbad8c702e9db0aa752b6d9f63ab41cd15520a955db42fd
572e60bad91adcc0711b6c93408bc73812d05a7485b0f2a5125f4e3af19dcba0
152a044d6ead756bf25102941ae5347d21c1eee29811dff7ac86c216d430745b
8359a347a41ef75b7a1591d2bd81372d24e25aab079e08ab7185bdbb0948955c
6158db38e1e3e80e0df2aa2a2b5d0a58d4064e669ac879446ba11443a8b881a9
ec0d3113557b7cc0d2d5123ac45922d40e34209fce8cfc2b665cf18cb34b691c
dc952defb4644f600950afcadd4e252a529ad737788a13f4a653fa2ed65e4f5c
d6cbeb563b46bd0ec0c779dd9f986ac65c6e8ee2ac28e7157af2db2533974da6
94e23d967addf03cbf052e8d346f875fb8320b0a5ebec4a3dd3e83f4b7616caa
74edab3b0ba41b9d02d35d1b4b5a5791990711920ad81a3b7bcaabfcc45c4c5a
83172a05a1bf277edad661d291cf26ed197ff9917a878e00d980e6748e3541a7
0bde9e8c209c4a3a4f09e02d127dadddb1c9a73b35166bf3c0812e69e6b1f068
e77ae5cb696891c9c81ec6c871261968ae12c334cd1d145c7f5f9e0115181dd5
239a4626ed96608fc7d5c5a84bd05cb547b222b103ca17eeaab7ea45c3f3ff22
e69e4141ad09e3e1a108c0719c131468a36c785d2a9d0930a3631e28a72ef782
5b864f12ca96654596244a7233fda37fdbd0776687fc24b54a7a351d6b0b4d3c
bdd67a2d07debbf8140da392ef933eb53172beae105a4981e7bf8938f393e667
baf8248b9b2c0a0a97ccbca60cc194a0dd15e48a17768afaf043799404db176d
e7006b8d71261b865d8601aa6e3b62f6b619f9d93ce857b288f9555cb17d5153
4b3aacacceebfe9cc6607c1b55eb9f1f3dd205a96b9bbfd0b38d433397d3c9a5
00248ecc4cde5256ee679fc0cecad0dea666940d064000d631882fadb4fea195
2eaebd7330e5901c36a1b1ad738cf6c76346c8525d89f16bacf4c1a9822fd993
549049c206798ac82da3d7bf88fec6d324737390070547998c0828b916905d9c
67de75fa63b6f101a2da5e047edd26ee239cc1767d716c2690d55bfb3e49882d
35214fb8ab4acfce9a6e0caae407e3b4d4aa374bf96c5596c49e342305d193de
ef8f11e6329370a13d6a82056ca5dadfa4a611ffdb719bd523a9c25b8ad07297
5811521cf05b04befec57554827f8426ea8743bcca3c7838872d1f58e4149cbb
fec91dbceed820feb3d8a348370841492348c5b370811eaab263013fd09ad218
SH256 hash:
3bf78bec9c2e2c0d7acd0b0b79d7441f1a7c4cb0d982ed7e299c9b9a27bbb78a
MD5 hash:
14b060c9c230c1272d8cd31f6e82cb8b
SHA1 hash:
4445697bb79b2d9e8caf7cdf41ab76b4f4b2dacc
Detections:
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
Parent samples :
933376e38f0ef413916ab8cd713b9b44b57f152c7d2e9ecb4af5b514012925c3
8044914fef05ba9c7505662b3bc53edfb8a376cd0383d5f81d35a3797a9339da
61b5dc04ec8d88a18260a3dfe42344ec5630c6af7204246429ccf48b0dedaf5c
249ff8adcaf0914424769055cc293a3114a071fd260073de2455d6f501971aa2
6b78dfce3fe9f54b8af722e912304dc97b681ff6d9ff3d77e3007b446443ba26
12ec771c6e24cc918e07de4b2a7b8be06b74bf1bfb2a0dbe0efac09e24bb9403
d668ad781ee9b81de4e5da26889308f4f7c496f68cf9001862b7a9d1b5e16cf3
8e98ea41349271538cbad8c702e9db0aa752b6d9f63ab41cd15520a955db42fd
572e60bad91adcc0711b6c93408bc73812d05a7485b0f2a5125f4e3af19dcba0
152a044d6ead756bf25102941ae5347d21c1eee29811dff7ac86c216d430745b
8359a347a41ef75b7a1591d2bd81372d24e25aab079e08ab7185bdbb0948955c
6158db38e1e3e80e0df2aa2a2b5d0a58d4064e669ac879446ba11443a8b881a9
ec0d3113557b7cc0d2d5123ac45922d40e34209fce8cfc2b665cf18cb34b691c
dc952defb4644f600950afcadd4e252a529ad737788a13f4a653fa2ed65e4f5c
d6cbeb563b46bd0ec0c779dd9f986ac65c6e8ee2ac28e7157af2db2533974da6
94e23d967addf03cbf052e8d346f875fb8320b0a5ebec4a3dd3e83f4b7616caa
74edab3b0ba41b9d02d35d1b4b5a5791990711920ad81a3b7bcaabfcc45c4c5a
83172a05a1bf277edad661d291cf26ed197ff9917a878e00d980e6748e3541a7
0bde9e8c209c4a3a4f09e02d127dadddb1c9a73b35166bf3c0812e69e6b1f068
e77ae5cb696891c9c81ec6c871261968ae12c334cd1d145c7f5f9e0115181dd5
239a4626ed96608fc7d5c5a84bd05cb547b222b103ca17eeaab7ea45c3f3ff22
e69e4141ad09e3e1a108c0719c131468a36c785d2a9d0930a3631e28a72ef782
5b864f12ca96654596244a7233fda37fdbd0776687fc24b54a7a351d6b0b4d3c
bdd67a2d07debbf8140da392ef933eb53172beae105a4981e7bf8938f393e667
baf8248b9b2c0a0a97ccbca60cc194a0dd15e48a17768afaf043799404db176d
e7006b8d71261b865d8601aa6e3b62f6b619f9d93ce857b288f9555cb17d5153
4b3aacacceebfe9cc6607c1b55eb9f1f3dd205a96b9bbfd0b38d433397d3c9a5
00248ecc4cde5256ee679fc0cecad0dea666940d064000d631882fadb4fea195
2eaebd7330e5901c36a1b1ad738cf6c76346c8525d89f16bacf4c1a9822fd993
549049c206798ac82da3d7bf88fec6d324737390070547998c0828b916905d9c
67de75fa63b6f101a2da5e047edd26ee239cc1767d716c2690d55bfb3e49882d
35214fb8ab4acfce9a6e0caae407e3b4d4aa374bf96c5596c49e342305d193de
ef8f11e6329370a13d6a82056ca5dadfa4a611ffdb719bd523a9c25b8ad07297
5811521cf05b04befec57554827f8426ea8743bcca3c7838872d1f58e4149cbb
fec91dbceed820feb3d8a348370841492348c5b370811eaab263013fd09ad218
SH256 hash:
5dced280508f61d6b5a73eb478abb0f6d8165d239577d7d4bca2953019fbdd9a
MD5 hash:
d21174205d0df27c7ebaaec34b6d2e06
SHA1 hash:
efcd88425bc8580d5d881530bdd2abcc08f77715
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
SH256 hash:
d5264d0a59feabbab9333ff9af67ad8fa0281e88a3ece71710f116106f82346b
MD5 hash:
865d34909949f9bcee471da09ffe424c
SHA1 hash:
d2b47e54c1b5a747b59fead6c548a7465f5111c3
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
SH256 hash:
9fe6c8c1963ab952f1223e6286f61deb572910a858b697538901975030c58386
MD5 hash:
f8842e38a7d10714f0e4e61814c2d318
SHA1 hash:
bff1191f3197010f9536ed10a2f04edb31856bb4
Detections:
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
Parent samples :
933376e38f0ef413916ab8cd713b9b44b57f152c7d2e9ecb4af5b514012925c3
8044914fef05ba9c7505662b3bc53edfb8a376cd0383d5f81d35a3797a9339da
61b5dc04ec8d88a18260a3dfe42344ec5630c6af7204246429ccf48b0dedaf5c
249ff8adcaf0914424769055cc293a3114a071fd260073de2455d6f501971aa2
6b78dfce3fe9f54b8af722e912304dc97b681ff6d9ff3d77e3007b446443ba26
12ec771c6e24cc918e07de4b2a7b8be06b74bf1bfb2a0dbe0efac09e24bb9403
d668ad781ee9b81de4e5da26889308f4f7c496f68cf9001862b7a9d1b5e16cf3
8e98ea41349271538cbad8c702e9db0aa752b6d9f63ab41cd15520a955db42fd
572e60bad91adcc0711b6c93408bc73812d05a7485b0f2a5125f4e3af19dcba0
152a044d6ead756bf25102941ae5347d21c1eee29811dff7ac86c216d430745b
8359a347a41ef75b7a1591d2bd81372d24e25aab079e08ab7185bdbb0948955c
6158db38e1e3e80e0df2aa2a2b5d0a58d4064e669ac879446ba11443a8b881a9
ec0d3113557b7cc0d2d5123ac45922d40e34209fce8cfc2b665cf18cb34b691c
dc952defb4644f600950afcadd4e252a529ad737788a13f4a653fa2ed65e4f5c
d6cbeb563b46bd0ec0c779dd9f986ac65c6e8ee2ac28e7157af2db2533974da6
94e23d967addf03cbf052e8d346f875fb8320b0a5ebec4a3dd3e83f4b7616caa
74edab3b0ba41b9d02d35d1b4b5a5791990711920ad81a3b7bcaabfcc45c4c5a
83172a05a1bf277edad661d291cf26ed197ff9917a878e00d980e6748e3541a7
0bde9e8c209c4a3a4f09e02d127dadddb1c9a73b35166bf3c0812e69e6b1f068
e77ae5cb696891c9c81ec6c871261968ae12c334cd1d145c7f5f9e0115181dd5
239a4626ed96608fc7d5c5a84bd05cb547b222b103ca17eeaab7ea45c3f3ff22
e69e4141ad09e3e1a108c0719c131468a36c785d2a9d0930a3631e28a72ef782
5b864f12ca96654596244a7233fda37fdbd0776687fc24b54a7a351d6b0b4d3c
bdd67a2d07debbf8140da392ef933eb53172beae105a4981e7bf8938f393e667
baf8248b9b2c0a0a97ccbca60cc194a0dd15e48a17768afaf043799404db176d
e7006b8d71261b865d8601aa6e3b62f6b619f9d93ce857b288f9555cb17d5153
4b3aacacceebfe9cc6607c1b55eb9f1f3dd205a96b9bbfd0b38d433397d3c9a5
00248ecc4cde5256ee679fc0cecad0dea666940d064000d631882fadb4fea195
2eaebd7330e5901c36a1b1ad738cf6c76346c8525d89f16bacf4c1a9822fd993
549049c206798ac82da3d7bf88fec6d324737390070547998c0828b916905d9c
67de75fa63b6f101a2da5e047edd26ee239cc1767d716c2690d55bfb3e49882d
35214fb8ab4acfce9a6e0caae407e3b4d4aa374bf96c5596c49e342305d193de
ef8f11e6329370a13d6a82056ca5dadfa4a611ffdb719bd523a9c25b8ad07297
5811521cf05b04befec57554827f8426ea8743bcca3c7838872d1f58e4149cbb
fec91dbceed820feb3d8a348370841492348c5b370811eaab263013fd09ad218
SH256 hash:
3bf78bec9c2e2c0d7acd0b0b79d7441f1a7c4cb0d982ed7e299c9b9a27bbb78a
MD5 hash:
14b060c9c230c1272d8cd31f6e82cb8b
SHA1 hash:
4445697bb79b2d9e8caf7cdf41ab76b4f4b2dacc
Detections:
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
Parent samples :
933376e38f0ef413916ab8cd713b9b44b57f152c7d2e9ecb4af5b514012925c3
8044914fef05ba9c7505662b3bc53edfb8a376cd0383d5f81d35a3797a9339da
61b5dc04ec8d88a18260a3dfe42344ec5630c6af7204246429ccf48b0dedaf5c
249ff8adcaf0914424769055cc293a3114a071fd260073de2455d6f501971aa2
6b78dfce3fe9f54b8af722e912304dc97b681ff6d9ff3d77e3007b446443ba26
12ec771c6e24cc918e07de4b2a7b8be06b74bf1bfb2a0dbe0efac09e24bb9403
d668ad781ee9b81de4e5da26889308f4f7c496f68cf9001862b7a9d1b5e16cf3
8e98ea41349271538cbad8c702e9db0aa752b6d9f63ab41cd15520a955db42fd
572e60bad91adcc0711b6c93408bc73812d05a7485b0f2a5125f4e3af19dcba0
152a044d6ead756bf25102941ae5347d21c1eee29811dff7ac86c216d430745b
8359a347a41ef75b7a1591d2bd81372d24e25aab079e08ab7185bdbb0948955c
6158db38e1e3e80e0df2aa2a2b5d0a58d4064e669ac879446ba11443a8b881a9
ec0d3113557b7cc0d2d5123ac45922d40e34209fce8cfc2b665cf18cb34b691c
dc952defb4644f600950afcadd4e252a529ad737788a13f4a653fa2ed65e4f5c
d6cbeb563b46bd0ec0c779dd9f986ac65c6e8ee2ac28e7157af2db2533974da6
94e23d967addf03cbf052e8d346f875fb8320b0a5ebec4a3dd3e83f4b7616caa
74edab3b0ba41b9d02d35d1b4b5a5791990711920ad81a3b7bcaabfcc45c4c5a
83172a05a1bf277edad661d291cf26ed197ff9917a878e00d980e6748e3541a7
0bde9e8c209c4a3a4f09e02d127dadddb1c9a73b35166bf3c0812e69e6b1f068
e77ae5cb696891c9c81ec6c871261968ae12c334cd1d145c7f5f9e0115181dd5
239a4626ed96608fc7d5c5a84bd05cb547b222b103ca17eeaab7ea45c3f3ff22
e69e4141ad09e3e1a108c0719c131468a36c785d2a9d0930a3631e28a72ef782
5b864f12ca96654596244a7233fda37fdbd0776687fc24b54a7a351d6b0b4d3c
bdd67a2d07debbf8140da392ef933eb53172beae105a4981e7bf8938f393e667
baf8248b9b2c0a0a97ccbca60cc194a0dd15e48a17768afaf043799404db176d
e7006b8d71261b865d8601aa6e3b62f6b619f9d93ce857b288f9555cb17d5153
4b3aacacceebfe9cc6607c1b55eb9f1f3dd205a96b9bbfd0b38d433397d3c9a5
00248ecc4cde5256ee679fc0cecad0dea666940d064000d631882fadb4fea195
2eaebd7330e5901c36a1b1ad738cf6c76346c8525d89f16bacf4c1a9822fd993
549049c206798ac82da3d7bf88fec6d324737390070547998c0828b916905d9c
67de75fa63b6f101a2da5e047edd26ee239cc1767d716c2690d55bfb3e49882d
35214fb8ab4acfce9a6e0caae407e3b4d4aa374bf96c5596c49e342305d193de
ef8f11e6329370a13d6a82056ca5dadfa4a611ffdb719bd523a9c25b8ad07297
5811521cf05b04befec57554827f8426ea8743bcca3c7838872d1f58e4149cbb
fec91dbceed820feb3d8a348370841492348c5b370811eaab263013fd09ad218
SH256 hash:
5dced280508f61d6b5a73eb478abb0f6d8165d239577d7d4bca2953019fbdd9a
MD5 hash:
d21174205d0df27c7ebaaec34b6d2e06
SHA1 hash:
efcd88425bc8580d5d881530bdd2abcc08f77715
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
SH256 hash:
d5264d0a59feabbab9333ff9af67ad8fa0281e88a3ece71710f116106f82346b
MD5 hash:
865d34909949f9bcee471da09ffe424c
SHA1 hash:
d2b47e54c1b5a747b59fead6c548a7465f5111c3
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
SH256 hash:
9fe6c8c1963ab952f1223e6286f61deb572910a858b697538901975030c58386
MD5 hash:
f8842e38a7d10714f0e4e61814c2d318
SHA1 hash:
bff1191f3197010f9536ed10a2f04edb31856bb4
Detections:
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
Parent samples :
933376e38f0ef413916ab8cd713b9b44b57f152c7d2e9ecb4af5b514012925c3
8044914fef05ba9c7505662b3bc53edfb8a376cd0383d5f81d35a3797a9339da
61b5dc04ec8d88a18260a3dfe42344ec5630c6af7204246429ccf48b0dedaf5c
249ff8adcaf0914424769055cc293a3114a071fd260073de2455d6f501971aa2
6b78dfce3fe9f54b8af722e912304dc97b681ff6d9ff3d77e3007b446443ba26
12ec771c6e24cc918e07de4b2a7b8be06b74bf1bfb2a0dbe0efac09e24bb9403
d668ad781ee9b81de4e5da26889308f4f7c496f68cf9001862b7a9d1b5e16cf3
8e98ea41349271538cbad8c702e9db0aa752b6d9f63ab41cd15520a955db42fd
572e60bad91adcc0711b6c93408bc73812d05a7485b0f2a5125f4e3af19dcba0
152a044d6ead756bf25102941ae5347d21c1eee29811dff7ac86c216d430745b
8359a347a41ef75b7a1591d2bd81372d24e25aab079e08ab7185bdbb0948955c
6158db38e1e3e80e0df2aa2a2b5d0a58d4064e669ac879446ba11443a8b881a9
ec0d3113557b7cc0d2d5123ac45922d40e34209fce8cfc2b665cf18cb34b691c
dc952defb4644f600950afcadd4e252a529ad737788a13f4a653fa2ed65e4f5c
d6cbeb563b46bd0ec0c779dd9f986ac65c6e8ee2ac28e7157af2db2533974da6
94e23d967addf03cbf052e8d346f875fb8320b0a5ebec4a3dd3e83f4b7616caa
74edab3b0ba41b9d02d35d1b4b5a5791990711920ad81a3b7bcaabfcc45c4c5a
83172a05a1bf277edad661d291cf26ed197ff9917a878e00d980e6748e3541a7
0bde9e8c209c4a3a4f09e02d127dadddb1c9a73b35166bf3c0812e69e6b1f068
e77ae5cb696891c9c81ec6c871261968ae12c334cd1d145c7f5f9e0115181dd5
239a4626ed96608fc7d5c5a84bd05cb547b222b103ca17eeaab7ea45c3f3ff22
e69e4141ad09e3e1a108c0719c131468a36c785d2a9d0930a3631e28a72ef782
5b864f12ca96654596244a7233fda37fdbd0776687fc24b54a7a351d6b0b4d3c
bdd67a2d07debbf8140da392ef933eb53172beae105a4981e7bf8938f393e667
baf8248b9b2c0a0a97ccbca60cc194a0dd15e48a17768afaf043799404db176d
e7006b8d71261b865d8601aa6e3b62f6b619f9d93ce857b288f9555cb17d5153
4b3aacacceebfe9cc6607c1b55eb9f1f3dd205a96b9bbfd0b38d433397d3c9a5
00248ecc4cde5256ee679fc0cecad0dea666940d064000d631882fadb4fea195
2eaebd7330e5901c36a1b1ad738cf6c76346c8525d89f16bacf4c1a9822fd993
549049c206798ac82da3d7bf88fec6d324737390070547998c0828b916905d9c
67de75fa63b6f101a2da5e047edd26ee239cc1767d716c2690d55bfb3e49882d
35214fb8ab4acfce9a6e0caae407e3b4d4aa374bf96c5596c49e342305d193de
ef8f11e6329370a13d6a82056ca5dadfa4a611ffdb719bd523a9c25b8ad07297
5811521cf05b04befec57554827f8426ea8743bcca3c7838872d1f58e4149cbb
fec91dbceed820feb3d8a348370841492348c5b370811eaab263013fd09ad218
SH256 hash:
3bf78bec9c2e2c0d7acd0b0b79d7441f1a7c4cb0d982ed7e299c9b9a27bbb78a
MD5 hash:
14b060c9c230c1272d8cd31f6e82cb8b
SHA1 hash:
4445697bb79b2d9e8caf7cdf41ab76b4f4b2dacc
Detections:
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
Parent samples :
933376e38f0ef413916ab8cd713b9b44b57f152c7d2e9ecb4af5b514012925c3
8044914fef05ba9c7505662b3bc53edfb8a376cd0383d5f81d35a3797a9339da
61b5dc04ec8d88a18260a3dfe42344ec5630c6af7204246429ccf48b0dedaf5c
249ff8adcaf0914424769055cc293a3114a071fd260073de2455d6f501971aa2
6b78dfce3fe9f54b8af722e912304dc97b681ff6d9ff3d77e3007b446443ba26
12ec771c6e24cc918e07de4b2a7b8be06b74bf1bfb2a0dbe0efac09e24bb9403
d668ad781ee9b81de4e5da26889308f4f7c496f68cf9001862b7a9d1b5e16cf3
8e98ea41349271538cbad8c702e9db0aa752b6d9f63ab41cd15520a955db42fd
572e60bad91adcc0711b6c93408bc73812d05a7485b0f2a5125f4e3af19dcba0
152a044d6ead756bf25102941ae5347d21c1eee29811dff7ac86c216d430745b
8359a347a41ef75b7a1591d2bd81372d24e25aab079e08ab7185bdbb0948955c
6158db38e1e3e80e0df2aa2a2b5d0a58d4064e669ac879446ba11443a8b881a9
ec0d3113557b7cc0d2d5123ac45922d40e34209fce8cfc2b665cf18cb34b691c
dc952defb4644f600950afcadd4e252a529ad737788a13f4a653fa2ed65e4f5c
d6cbeb563b46bd0ec0c779dd9f986ac65c6e8ee2ac28e7157af2db2533974da6
94e23d967addf03cbf052e8d346f875fb8320b0a5ebec4a3dd3e83f4b7616caa
74edab3b0ba41b9d02d35d1b4b5a5791990711920ad81a3b7bcaabfcc45c4c5a
83172a05a1bf277edad661d291cf26ed197ff9917a878e00d980e6748e3541a7
0bde9e8c209c4a3a4f09e02d127dadddb1c9a73b35166bf3c0812e69e6b1f068
e77ae5cb696891c9c81ec6c871261968ae12c334cd1d145c7f5f9e0115181dd5
239a4626ed96608fc7d5c5a84bd05cb547b222b103ca17eeaab7ea45c3f3ff22
e69e4141ad09e3e1a108c0719c131468a36c785d2a9d0930a3631e28a72ef782
5b864f12ca96654596244a7233fda37fdbd0776687fc24b54a7a351d6b0b4d3c
bdd67a2d07debbf8140da392ef933eb53172beae105a4981e7bf8938f393e667
baf8248b9b2c0a0a97ccbca60cc194a0dd15e48a17768afaf043799404db176d
e7006b8d71261b865d8601aa6e3b62f6b619f9d93ce857b288f9555cb17d5153
4b3aacacceebfe9cc6607c1b55eb9f1f3dd205a96b9bbfd0b38d433397d3c9a5
00248ecc4cde5256ee679fc0cecad0dea666940d064000d631882fadb4fea195
2eaebd7330e5901c36a1b1ad738cf6c76346c8525d89f16bacf4c1a9822fd993
549049c206798ac82da3d7bf88fec6d324737390070547998c0828b916905d9c
67de75fa63b6f101a2da5e047edd26ee239cc1767d716c2690d55bfb3e49882d
35214fb8ab4acfce9a6e0caae407e3b4d4aa374bf96c5596c49e342305d193de
ef8f11e6329370a13d6a82056ca5dadfa4a611ffdb719bd523a9c25b8ad07297
5811521cf05b04befec57554827f8426ea8743bcca3c7838872d1f58e4149cbb
fec91dbceed820feb3d8a348370841492348c5b370811eaab263013fd09ad218
SH256 hash:
5dced280508f61d6b5a73eb478abb0f6d8165d239577d7d4bca2953019fbdd9a
MD5 hash:
d21174205d0df27c7ebaaec34b6d2e06
SHA1 hash:
efcd88425bc8580d5d881530bdd2abcc08f77715
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
SH256 hash:
d5264d0a59feabbab9333ff9af67ad8fa0281e88a3ece71710f116106f82346b
MD5 hash:
865d34909949f9bcee471da09ffe424c
SHA1 hash:
d2b47e54c1b5a747b59fead6c548a7465f5111c3
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
SH256 hash:
9fe6c8c1963ab952f1223e6286f61deb572910a858b697538901975030c58386
MD5 hash:
f8842e38a7d10714f0e4e61814c2d318
SHA1 hash:
bff1191f3197010f9536ed10a2f04edb31856bb4
Detections:
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
Parent samples :
933376e38f0ef413916ab8cd713b9b44b57f152c7d2e9ecb4af5b514012925c3
8044914fef05ba9c7505662b3bc53edfb8a376cd0383d5f81d35a3797a9339da
61b5dc04ec8d88a18260a3dfe42344ec5630c6af7204246429ccf48b0dedaf5c
249ff8adcaf0914424769055cc293a3114a071fd260073de2455d6f501971aa2
6b78dfce3fe9f54b8af722e912304dc97b681ff6d9ff3d77e3007b446443ba26
12ec771c6e24cc918e07de4b2a7b8be06b74bf1bfb2a0dbe0efac09e24bb9403
d668ad781ee9b81de4e5da26889308f4f7c496f68cf9001862b7a9d1b5e16cf3
8e98ea41349271538cbad8c702e9db0aa752b6d9f63ab41cd15520a955db42fd
572e60bad91adcc0711b6c93408bc73812d05a7485b0f2a5125f4e3af19dcba0
152a044d6ead756bf25102941ae5347d21c1eee29811dff7ac86c216d430745b
8359a347a41ef75b7a1591d2bd81372d24e25aab079e08ab7185bdbb0948955c
6158db38e1e3e80e0df2aa2a2b5d0a58d4064e669ac879446ba11443a8b881a9
ec0d3113557b7cc0d2d5123ac45922d40e34209fce8cfc2b665cf18cb34b691c
dc952defb4644f600950afcadd4e252a529ad737788a13f4a653fa2ed65e4f5c
d6cbeb563b46bd0ec0c779dd9f986ac65c6e8ee2ac28e7157af2db2533974da6
94e23d967addf03cbf052e8d346f875fb8320b0a5ebec4a3dd3e83f4b7616caa
74edab3b0ba41b9d02d35d1b4b5a5791990711920ad81a3b7bcaabfcc45c4c5a
83172a05a1bf277edad661d291cf26ed197ff9917a878e00d980e6748e3541a7
0bde9e8c209c4a3a4f09e02d127dadddb1c9a73b35166bf3c0812e69e6b1f068
e77ae5cb696891c9c81ec6c871261968ae12c334cd1d145c7f5f9e0115181dd5
239a4626ed96608fc7d5c5a84bd05cb547b222b103ca17eeaab7ea45c3f3ff22
e69e4141ad09e3e1a108c0719c131468a36c785d2a9d0930a3631e28a72ef782
5b864f12ca96654596244a7233fda37fdbd0776687fc24b54a7a351d6b0b4d3c
bdd67a2d07debbf8140da392ef933eb53172beae105a4981e7bf8938f393e667
baf8248b9b2c0a0a97ccbca60cc194a0dd15e48a17768afaf043799404db176d
e7006b8d71261b865d8601aa6e3b62f6b619f9d93ce857b288f9555cb17d5153
4b3aacacceebfe9cc6607c1b55eb9f1f3dd205a96b9bbfd0b38d433397d3c9a5
00248ecc4cde5256ee679fc0cecad0dea666940d064000d631882fadb4fea195
2eaebd7330e5901c36a1b1ad738cf6c76346c8525d89f16bacf4c1a9822fd993
549049c206798ac82da3d7bf88fec6d324737390070547998c0828b916905d9c
67de75fa63b6f101a2da5e047edd26ee239cc1767d716c2690d55bfb3e49882d
35214fb8ab4acfce9a6e0caae407e3b4d4aa374bf96c5596c49e342305d193de
ef8f11e6329370a13d6a82056ca5dadfa4a611ffdb719bd523a9c25b8ad07297
5811521cf05b04befec57554827f8426ea8743bcca3c7838872d1f58e4149cbb
fec91dbceed820feb3d8a348370841492348c5b370811eaab263013fd09ad218
SH256 hash:
3bf78bec9c2e2c0d7acd0b0b79d7441f1a7c4cb0d982ed7e299c9b9a27bbb78a
MD5 hash:
14b060c9c230c1272d8cd31f6e82cb8b
SHA1 hash:
4445697bb79b2d9e8caf7cdf41ab76b4f4b2dacc
Detections:
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
redline
Create hunting rule
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
Parent samples :
933376e38f0ef413916ab8cd713b9b44b57f152c7d2e9ecb4af5b514012925c3
8044914fef05ba9c7505662b3bc53edfb8a376cd0383d5f81d35a3797a9339da
61b5dc04ec8d88a18260a3dfe42344ec5630c6af7204246429ccf48b0dedaf5c
249ff8adcaf0914424769055cc293a3114a071fd260073de2455d6f501971aa2
6b78dfce3fe9f54b8af722e912304dc97b681ff6d9ff3d77e3007b446443ba26
12ec771c6e24cc918e07de4b2a7b8be06b74bf1bfb2a0dbe0efac09e24bb9403
d668ad781ee9b81de4e5da26889308f4f7c496f68cf9001862b7a9d1b5e16cf3
8e98ea41349271538cbad8c702e9db0aa752b6d9f63ab41cd15520a955db42fd
572e60bad91adcc0711b6c93408bc73812d05a7485b0f2a5125f4e3af19dcba0
152a044d6ead756bf25102941ae5347d21c1eee29811dff7ac86c216d430745b
8359a347a41ef75b7a1591d2bd81372d24e25aab079e08ab7185bdbb0948955c
6158db38e1e3e80e0df2aa2a2b5d0a58d4064e669ac879446ba11443a8b881a9
ec0d3113557b7cc0d2d5123ac45922d40e34209fce8cfc2b665cf18cb34b691c
dc952defb4644f600950afcadd4e252a529ad737788a13f4a653fa2ed65e4f5c
d6cbeb563b46bd0ec0c779dd9f986ac65c6e8ee2ac28e7157af2db2533974da6
94e23d967addf03cbf052e8d346f875fb8320b0a5ebec4a3dd3e83f4b7616caa
74edab3b0ba41b9d02d35d1b4b5a5791990711920ad81a3b7bcaabfcc45c4c5a
83172a05a1bf277edad661d291cf26ed197ff9917a878e00d980e6748e3541a7
0bde9e8c209c4a3a4f09e02d127dadddb1c9a73b35166bf3c0812e69e6b1f068
e77ae5cb696891c9c81ec6c871261968ae12c334cd1d145c7f5f9e0115181dd5
239a4626ed96608fc7d5c5a84bd05cb547b222b103ca17eeaab7ea45c3f3ff22
e69e4141ad09e3e1a108c0719c131468a36c785d2a9d0930a3631e28a72ef782
5b864f12ca96654596244a7233fda37fdbd0776687fc24b54a7a351d6b0b4d3c
bdd67a2d07debbf8140da392ef933eb53172beae105a4981e7bf8938f393e667
baf8248b9b2c0a0a97ccbca60cc194a0dd15e48a17768afaf043799404db176d
e7006b8d71261b865d8601aa6e3b62f6b619f9d93ce857b288f9555cb17d5153
4b3aacacceebfe9cc6607c1b55eb9f1f3dd205a96b9bbfd0b38d433397d3c9a5
00248ecc4cde5256ee679fc0cecad0dea666940d064000d631882fadb4fea195
2eaebd7330e5901c36a1b1ad738cf6c76346c8525d89f16bacf4c1a9822fd993
549049c206798ac82da3d7bf88fec6d324737390070547998c0828b916905d9c
67de75fa63b6f101a2da5e047edd26ee239cc1767d716c2690d55bfb3e49882d
35214fb8ab4acfce9a6e0caae407e3b4d4aa374bf96c5596c49e342305d193de
ef8f11e6329370a13d6a82056ca5dadfa4a611ffdb719bd523a9c25b8ad07297
5811521cf05b04befec57554827f8426ea8743bcca3c7838872d1f58e4149cbb
fec91dbceed820feb3d8a348370841492348c5b370811eaab263013fd09ad218
SH256 hash:
d668ad781ee9b81de4e5da26889308f4f7c496f68cf9001862b7a9d1b5e16cf3
MD5 hash:
7b1c01344bf970909296e1552781f405
SHA1 hash:
bd47410e784917acada783ddbe6bdd2aa7606ae9
Link:
https://www.unpac.me/results/e7923646-ed3e-49b0-a380-a73b02e49db8/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d668ad781ee9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/414853/
  
URLhaus
https://urlhaus.abuse.ch/url/2680005/
  
URLhaus
https://urlhaus.abuse.ch/url/2673974/

Comments