MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6d85835ef15c620641b03e41518ec61393f70c4740c839d7f753b6ae2a58ed3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6d85835ef15c620641b03e41518ec61393f70c4740c839d7f753b6ae2a58ed3
SHA3-384 hash: 30b6cc544f8220aab50325498508a8103d8b245c15534d2782605f3fca657c4de285305ab74d5fd1ff4a05e0d2cf6076
SHA1 hash: 9a3e9d95f66be2eba6dfd883c56982704955ea20
MD5 hash: 0bd201b37dcb668316426a165a30259b
humanhash: magazine-blue-steak-failed
File name:0bd201b37dcb668316426a165a30259b.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:10'458'119 bytes
First seen:2022-04-16 08:55:46 UTC
Last seen:2022-04-20 10:23:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 32569d67dc210c5cb9a759b08da2bdb3 (122 x RedLineStealer, 42 x DiamondFox, 37 x RaccoonStealer)
ssdeep 196608:xQZaA8VdUVlq6vGg/I99qj0z6ZXJqrMChFE38TaNvsCFp9HRCozCYPW1:xUaAQdUVGgY80z6ZX0MEi3XNhp9Hpbc
Threatray 7'923 similar samples on MalwareBazaar
TLSH T131B6335477AB10F3E14E62B2E2846FB45B31971D0A21C147EA412D1F8F7AD5839ABCCB
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10523/12/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
92.255.57.249:17606

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
92.255.57.249:17606 https://threatfox.abuse.ch/ioc/520337/

Intelligence

File Origin
# of uploads :
2
# of downloads :
440
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0bd201b37dcb668316426a165a30259b.exe
Verdict:
No threats detected
Analysis date:
2022-04-16 08:57:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c5b4b5db-1c53-4cd6-859f-3ac82be17bb4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Nymaim
Create hunting rule
Link:
https://www.capesandbox.com/analysis/264102/
Detection(s):
Win.Dropper.Pswtool-9857487-0
Create hunting rule

Win.Dropper.Pswtool-9857535-0
Create hunting rule

Win.Packed.Barys-9859263-0
Create hunting rule

Win.Malware.Barys-9859499-0
Create hunting rule

Win.Packed.Barys-9859531-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.36246775.27485.2482.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Searching for the window
Running batch commands
Launching a process
Using the Windows Management Instrumentation requests
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/14029/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed packed shell32.dll
Link:
https://www.filescan.io/uploads/625a84a7ffe27d5119e4f0d7/reports/63859ba1-b7c9-4770-a064-bf401cef21f3/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/014f1d19-c8f0-4bb9-8915-3327c1ff42a6
Result
Threat name:
Cookie Stealer RedLine SmokeLoader Socel
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/977663
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Creates processes via WMI
Detected unpacking (changes PE section rights)
Detected VMProtect packer
Disables Windows Defender (via service or powershell)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Query firmware table information (likely to detect VMs)
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Cookie Stealer
Yara detected Generic Downloader
Yara detected MSILDownloaderGeneric
Yara detected onlyLogger
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Socelars
Yara detected Zealer Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 610150 Sample: tHvjY1G08Y.exe Startdate: 16/04/2022 Architecture: WINDOWS Score: 100 84 92.255.57.249 TELSPRU Russian Federation 2->84 86 s3.pl-waw.scw.cloud 151.115.10.1, 49738, 80 OnlineSASFR United Kingdom 2->86 88 4 other IPs or domains 2->88 106 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->106 108 Multi AV Scanner detection for domain / URL 2->108 110 Malicious sample detected (through community Yara rule) 2->110 112 24 other signatures 2->112 11 tHvjY1G08Y.exe 23 2->11         started        14 WmiPrvSE.exe 2->14         started        signatures3 process4 file5 58 C:\Users\user\AppData\...\setup_install.exe, PE32 11->58 dropped 60 C:\Users\...\6255a35863105_Tue16501969900.exe, PE32 11->60 dropped 62 C:\Users\...\6255a357434ed_Tue1640ec558f.exe, PE32 11->62 dropped 64 18 other files (13 malicious) 11->64 dropped 16 setup_install.exe 1 11->16         started        process6 signatures7 104 Adds a directory exclusion to Windows Defender 16->104 19 cmd.exe 16->19         started        21 cmd.exe 16->21         started        23 cmd.exe 1 16->23         started        25 14 other processes 16->25 process8 signatures9 28 6255a3554fb0f_Tue1611e4e0.exe 19->28         started        33 6255a33640d43_Tue16dea4e5631.exe 21->33         started        35 6255a32e82d45_Tue16b36181c9f.exe 1 23->35         started        114 Adds a directory exclusion to Windows Defender 25->114 116 Disables Windows Defender (via service or powershell) 25->116 37 6255a33b6eea1_Tue1600a17736.exe 25->37         started        39 6255a3302bb14_Tue166cb01c.exe 25->39         started        41 6255a357434ed_Tue1640ec558f.exe 25->41         started        43 10 other processes 25->43 process10 dnsIp11 90 mbbsbangladesh.in 172.105.52.100, 49735, 49737, 80 LINODE-APLinodeLLCUS United States 28->90 92 blackhk1.beget.tech 5.101.153.227, 49734, 80 BEGET-ASRU Russian Federation 28->92 66 C:\Users\user\AppData\Local\Temp\HHL45.exe, PE32 28->66 dropped 68 C:\Users\user\AppData\Local\Temp\C552E.exe, PE32 28->68 dropped 70 C:\Users\user\AppData\...\63B46HD1BKEAG73.exe, PE32+ 28->70 dropped 78 2 other files (1 malicious) 28->78 dropped 120 Detected unpacking (changes PE section rights) 28->120 122 Query firmware table information (likely to detect VMs) 28->122 124 Tries to detect sandboxes and other dynamic analysis tools (window names) 28->124 140 2 other signatures 28->140 126 Multi AV Scanner detection for dropped file 33->126 142 5 other signatures 33->142 128 Disables Windows Defender (via service or powershell) 35->128 45 cmd.exe 35->45         started        94 ip-api.com 208.95.112.1, 49731, 80 TUT-ASUS United States 37->94 130 Antivirus detection for dropped file 37->130 132 May check the online IP address of the machine 37->132 134 Tries to detect virtualization through RDTSC time measurements 37->134 136 Injects a PE file into a foreign processes 39->136 96 iplogger.org 148.251.234.83, 443, 49736 HETZNER-ASDE Germany 41->96 98 www.icodeps.com 149.28.253.196, 443, 49730 AS-CHOOPAUS United States 41->98 100 212.192.246.217 RHC-HOSTINGGB Russian Federation 43->100 102 2 other IPs or domains 43->102 72 C:\...\6255a354a16ea_Tue16f02c315fd9.tmp, PE32 43->72 dropped 74 C:\...\6255a3347030f_Tue160ee793c118.tmp, PE32 43->74 dropped 76 C:\Users\user\AppData\Local\Temp\Mk2D.cpl, PE32 43->76 dropped 138 Obfuscated command line found 43->138 144 2 other signatures 43->144 48 6255a3321c83f_Tue16f1498efb.exe 43->48         started        52 6255a33d73e0a_Tue16626e005d23.exe 43->52         started        file12 signatures13 process14 dnsIp15 118 Disables Windows Defender (via service or powershell) 45->118 54 powershell.exe 45->54         started        80 104.21.40.196, 443, 49729 CLOUDFLARENETUS United States 48->80 82 v.xyzgamev.com 172.67.188.70, 443, 49725 CLOUDFLARENETUS United States 48->82 56 C:\Users\user\AppData\Local\Temp\db.dll, PE32 48->56 dropped file16 signatures17 process18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6d85835ef15c620641b03e41518ec61393f70c4740c839d7f753b6ae2a58ed3/
Threat name:
Win32.Trojan.MereTam
Create hunting rule
Status:
Malicious
First seen:
2022-04-13 03:44:00 UTC
File Type:
PE (Exe)
Extracted files:
349
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=23mfqnppcxdcaza3apsbkghmme4t64geoqgihhl7ou5wvyvfr3jq._file
Verdict:
malicious
Similar samples:
0063b80315ee40172ad671a0ffc408f27fe56d716749cc996b271601fd0a2a2c
RedLineStealer
022e85b0301517e90423006b4ea98ace33f914820228f0e5f2fab9d66219ac98
RedLineStealer
4618fb57958c19496e668916d769cb40e6bb0a0af0fbb1ff73ee89e701f3fe9b
RedLineStealer
4eebc9db13bf3a2bbae7f56ecdb4be388610bff9cdb4931f9d776762597286a6
RedLineStealer
8a8ed9f1dbe9f72dd7f60806be5130daf6148443a45d6c20d1449a4e490837c9
RedLineStealer
a8608c25f43dcab1c8501cb89b796d75b94a0abd260d3cee39a7e56e889326d6
RedLineStealer
dbeac36e7de274df245cf4965fcdbeedd57ef1637a9cb8c5bd8686645a9ee9fd
RedLineStealer
ebfe121f28f0cde253640238d03009c79d392a6bf5adfdb9aff509787505f88d
RedLineStealer
+ 7'913 additional samples on MalwareBazaar
Result
Malware family:
socelars
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader family:socelars botnet:media20207 botnet:same1 aspackv2 backdoor evasion infostealer spyware stealer themida trojan vmprotect
Link:
https://tria.ge/reports/220416-kv1yvagea9/
Behaviour
Checks SCSI registry key(s)
Delays execution with timeout.exe
Kills process with taskkill
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
AutoIT Executable
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Unexpected DNS network traffic destination
ASPack v2.12-2.42
Downloads MZ/PE file
Executes dropped EXE
VMProtect packed file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Process spawned unexpected child process
RedLine
RedLine Payload
SmokeLoader
Socelars
Socelars Payload
Malware Config
C2 Extraction:
https://sa-us-bucket.s3.us-east-2.amazonaws.com/vsdh41/
http://hanfinvest.at/upload/
http://phunilbeauty.com/upload/
http://spbdg.ru/upload/
http://tnt-az.com/upload/
http://casagenaro.com/upload/
http://girneotel.com/upload/
http://zennclinic.com/upload/
http://mordo.ru/forum/
http://piratia-life.ru/upload/
http://pkodev.net/upload/
92.255.57.249:17606
116.202.106.111:9582
Unpacked files
SH256 hash:
b7a32e5264a139fe6e45d395b61e0877039728f46242d32c6b1b4529dd9dce26
MD5 hash:
033328e67e74157911356755eabe4a21
SHA1 hash:
aec0696e1f9871b9d3a418bd0060d2cd11dad1df
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
51822e99ece18ac31a193079f264f10940417e7d65c8e16d55ceee7f743dc309
MD5 hash:
11d58bcdf92faf51179d2daaf99e11b3
SHA1 hash:
0c6ffc8f9db015ec1bd01e11420695faadf2c845
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
5153b60b002a0b82848661b6dc00df9e184ef2a3f800aac3e90f2f868b403c46
MD5 hash:
f99323ccbdf71989e975c21ef85ebe10
SHA1 hash:
bd71d9c530579b5944bfdd1a6a3b1b4f52f4eab3
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
054067ba23ab9f74d41afa919e7894800b8f93c992e8e40d6ad019e7cce9da63
MD5 hash:
9726d464ba60894a412adc78d541c0c2
SHA1 hash:
9a00e428610d20b925d7dd4249a5fddf6dd389df
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
94b1a1928663783d55d18e068691d41fda717aec2b8c139cbeec537baf590cf1
MD5 hash:
dbe67324ed2ee469fb8cc030ffaa3448
SHA1 hash:
c99473f88d6e73360fe671ef0eb624b71b94315f
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
8e7054b68ad1258fc328af2feecfb37e78954e81f57758b7dafb19008463b751
MD5 hash:
729b9ee6cf416ecb81f9f0e6b29c29e9
SHA1 hash:
e4365a80a6153216e4ce5770c1cd766177bcc7e3
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
1484f79a6b4ca183c3dabe79df8a2fe43a9fab9dc04c2f661879c41eaf51280b
MD5 hash:
b7825c100007e3f18abe0b4790f99ab7
SHA1 hash:
9a038e0203278ff1959a9fbaa8c038b313bfea4b
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
721d393191597d49d856baef2fbde75e48f52d0465e2cfabf1a41848b0e05589
MD5 hash:
b984a027c8a2abf874f3eb306a831613
SHA1 hash:
d3b3f8890adc840b0bd411cf304eef15d415ed48
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
Parent samples :
fb9b41efdc7c2d9e8cfda4be223831a9d2f4d21366759da64e04bbbb9e662766
bc9d49f4f0d51c57b34515616d5e6a23a37fec03f8884d8305db0806bd6138fc
ecb96fec4db4a1eecef04c8ef12b260bb419407111c1263664749481b7fa5387
98c920233869ce802fb4722f982fc1a8c2461e2a01ea4a619a9532a660acf285
2fde1682e006e27b2deb49595ab3baf37a836577fbe9efdfae59d4b6b682d8b7
2374069183727dd5904a26027c80032f30dcff60d25019578876c0b37fa9c224
bd3030832602591f05fe01ef11feaa3b9fe776b2a184eb454f02cae3ab73340b
a0f15f4665835bb7f3b07d5e96d2b08af8e88614c9b22fc9fff86f4f60ee1a8e
c91dec1cd5b97079481c76d5d597dde67b60c301ea900eab7db99776d52b465a
SH256 hash:
596e8a3522c1f703efb8c36d8cf84e126ce8c5dd0b180e479f55f81a819b1734
MD5 hash:
ff8d1151a9c1d5348877fa2f2b900d46
SHA1 hash:
fc281613b33e5178b0903f3d9c1960bbbb534e11
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
7dd366506a08d8f81e92a69adb67fcae30656dd27c3f1a96d17427b7aa4ac251
MD5 hash:
970a586e6ecd0f6af2dadd873684ebdd
SHA1 hash:
cd9561efd0869aab089e1702134ff6a87c859e56
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
f1ff9db6eb7270204ae42a24b553cab90d51ebe1ab2e455e729bab798858e194
MD5 hash:
70be8d643da1523060372d5e67800e58
SHA1 hash:
ccf6c87cdf5cb0e45aad5ab5153d36288983af65
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
2cc2b00b84d0ce2159297a7c33a8f38847d96e93dbfe7bb23724173886f99e6c
MD5 hash:
6b8b520c9ca2c721c5628a592d06f4a2
SHA1 hash:
cae37468adcdb03be8e990bba7c9f60cb74b977b
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
d2db85c6908927e26555f6d41a306f25c96e3165873ade28eb62364f5b444808
MD5 hash:
adb60c102ad6ea8f851720fee4d17371
SHA1 hash:
a05ad656fdea81ba1b284c2024fd77189722e6eb
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
ee556cb79b0a5b09a2615b7c50f7296ccc1f0af4b04496cea58b0be457dbb05b
MD5 hash:
84e439f37a9fc07030f06ed990bf327f
SHA1 hash:
7db36f9760bd030333ad4f15f25c4c8d0681e6e3
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
1c2818e60d15e1e486d03a9e7641b4e6f99f09d3c04e87037bebe19f6896d61b
MD5 hash:
1ae68c1c920dcbc29cb3ce6c1cf8100e
SHA1 hash:
6b624d460e5ffb643e0713f9dccca09f15792265
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
a89c1aa2ea74c762d66a3f3d313234ab81fccf9723f8e0915348ca4f13445c35
MD5 hash:
02052bfa13ccf9b9b7c9aec8a7b86bb1
SHA1 hash:
44a0c7d287a7ae87c5e070c6f5af25bfc257447b
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
a09a6e18d792c443ed76f03b5b04a025e50dfdf2e8f57e82c88874a8abb2d5ea
MD5 hash:
e04b35bd14db0c44a26705806ed27267
SHA1 hash:
4485f2a5108cc0d2c6e11528e4baddbd89f177cb
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
f0faee67bfe75d62b6b9c57d5f19887c869d8d8aa4041d61ccda31ff5100c722
MD5 hash:
34cb8398a38e7569daf8cc5b2d290eaa
SHA1 hash:
0f2ff995eb9ca5a141adcfb54589dfec10d03f7c
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
a7e37f5314834b163fa21557e61c13c0f202fd64d3c0e46e6c90d2d02e033aec
MD5 hash:
6faec01bf7a3d7f5c5dee2e6e3143a58
SHA1 hash:
603a36f817cab5574e58ab279379e5c112e5fb37
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
ed2cf14934d88fb0c73b4aace83ffdd6a3fc22823fff93946733431fdf6f9d46
MD5 hash:
d2ad4f41797d382b1ce045f8c1953309
SHA1 hash:
a4390607b94c3373a0df50be1077aca6fe4747c7
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
dc2ea74ea251a2873e802174236d27206dc7d561101107c1d8e18623fa4c5f5a
MD5 hash:
5cd4253328757b121dd77a933b82734f
SHA1 hash:
80dc31862fba30c9ee1bde753a0fa2a4da5d4743
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
e1c2b31904a7f856436a6ca97432beb0e87fb3c0f0e437b271d2d5885b044fdb
MD5 hash:
02604fffd9b7936ff36a8272dcc96396
SHA1 hash:
2b8a4f477153ed337256990e9af33e2d310450b3
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
befda19142edeff2eb7eb85476752cbe8edf226624bc5c69078f33dc5909d79f
MD5 hash:
b00e17299ba0cfcd8c6f2e135a6c6647
SHA1 hash:
0cf163b243ed878a830a9be4ad74d5287439e37f
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
9a974ffd067f5fe1a68604ab681bd9ef284d21fed6aa78d56a4ecfd1d2aff02d
MD5 hash:
57176dba66ddfd3adcd6b16feac52990
SHA1 hash:
70fbeccf858ef6a494b4fa8e4d2c18bb9b1c58d1
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
46ff95a7ad847378441f5c4bb277044960e3134592b505b594411ea2cb3fbda2
MD5 hash:
1ad1aff6b593600a135081f21833ff42
SHA1 hash:
7af6d7c99cc93263dd0d37622d26514e55cf5272
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
SH256 hash:
d6d85835ef15c620641b03e41518ec61393f70c4740c839d7f753b6ae2a58ed3
MD5 hash:
0bd201b37dcb668316426a165a30259b
SHA1 hash:
9a3e9d95f66be2eba6dfd883c56982704955ea20
Link:
https://www.unpac.me/results/29bf10cb-ecac-4447-9af9-78d8f43c3556/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d6d85835ef15c620641b03e41518ec61393f70c4740c839d7f753b6ae2a58ed3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Redline_Stealer_Monitor
Create hunting rule
Description:Detects RedLine Stealer Variants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/264102/

Comments