MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
SHA3-384 hash: 1b44a13aef7c99be6beeba7fd7422b0865ec17bbda0ed25435d5fd95b866f941325d8073978fe2ca9a25572beac7553f
SHA1 hash: be2c1470c46eb18c49500dd5bb07a7cabe588398
MD5 hash: 937768008be3b71478be77f512943a75
humanhash: jig-fanta-tango-north
File name:DC812FA1AE68DFA017CFDE268E2AE523019308B102BCE.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'454'874 bytes
First seen:2023-02-04 23:25:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 32569d67dc210c5cb9a759b08da2bdb3 (122 x RedLineStealer, 42 x DiamondFox, 37 x RaccoonStealer)
ssdeep 49152:xcBbNrb9o7jgMOHIT8SdFQE0+9DymbzgZklR2IM5AZ1UEEwJ84vLRaBtIl9mTScm:xerungqJnQrm/FP2wZ1WCvLUBsKScYv
TLSH T1E5F533B1B7D1C0B3E24417329ABD67B2E4B9D3EC173915873340924F8EA8956D13B5A3
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10523/12/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
51.89.207.166:47909

Intelligence

File Origin
# of uploads :
1
# of downloads :
224
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DAD9E695E9F592E48326DD349556F81987C115AD152BF.exe
Verdict:
Malicious activity
Analysis date:
2023-02-04 21:16:18 UTC
Tags:
evasion
Link:
https://app.any.run/tasks/2b7f80ba-932c-424e-a923-029b23b1fe39

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/360310/
Detection(s):
Win.Malware.Generic-9852703-0
Create hunting rule

Win.Packed.Barys-9859531-0
Create hunting rule

Win.Malware.Barys-9859544-0
Create hunting rule

Win.Malware.Barys-9859547-0
Create hunting rule

Win.Malware.Barys-9859550-0
Create hunting rule

Win.Trojan.Jaik-9862229-0
Create hunting rule

Win.Malware.Generic-9863888-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Win.Packed.Trojanx-9873669-0
Create hunting rule

Win.Packed.SmokeLoader-9873637-1
Create hunting rule

Win.Malware.Malwarex-9882661-0
Create hunting rule

Win.Dropper.Malwarex-9882944-0
Create hunting rule

Win.Malware.Generickdz-9883917-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Moving a file to the %temp% subdirectory
Running batch commands
Sending a custom TCP request
DNS request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Creating a process with a hidden window
Creating a window
Sending an HTTP GET request
Creating a file
Unauthorized injection to a recently created process
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/65340/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
arkeistealer overlay packed shell32.dll zusy
Link:
https://www.filescan.io/uploads/63dee98b89bd67c10fdc90f7/reports/9bf9741e-6a16-4070-bf77-9f34bd72b560/overview
Verdict:
Malicious
Labled as:
Dropper.Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ed2953f4-e0bb-4bb2-b6d5-851acbed6dbb
Result
Threat name:
PrivateLoader, Raccoon Stealer v2, RedLi
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1165880
Signature
.NET source code contains very large strings
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Detected VMProtect packer
Disable Windows Defender real time protection (registry)
Drops PE files to the document folder of the user
Found C&C like URL pattern
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Performs DNS queries to domains with low reputation
Query firmware table information (likely to detect VMs)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to resolve many domain names, but no domain seems valid
Yara detected Generic Downloader
Yara detected PrivateLoader
Yara detected Raccoon Stealer v2
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Vidar stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 798651 Sample: DC812FA1AE68DFA017CFDE268E2... Startdate: 05/02/2023 Architecture: WINDOWS Score: 100 122 live.goatgame.live 2->122 124 f.youtuuee.com 2->124 126 d23e708d-b6e8-44bc-9d45-f8c07ee06fbf.uuid.dg2sz7pxs7llf2t25fsbutlvvrjij4pmojugn75cmxnvoshmju6dzcad.onion 2->126 160 Snort IDS alert for network traffic 2->160 162 Multi AV Scanner detection for domain / URL 2->162 164 Malicious sample detected (through community Yara rule) 2->164 166 24 other signatures 2->166 11 DC812FA1AE68DFA017CFDE268E2AE523019308B102BCE.exe 17 2->11         started        14 svchost.exe 2->14         started        17 svchost.exe 2->17         started        19 7 other processes 2->19 signatures3 process4 file5 114 C:\Users\user\AppData\...\setup_install.exe, PE32 11->114 dropped 116 C:\Users\user\AppData\Local\...\sahiba_9.txt, PE32 11->116 dropped 118 C:\Users\user\AppData\Local\...\sahiba_8.txt, PE32 11->118 dropped 120 12 other files (11 malicious) 11->120 dropped 21 setup_install.exe 1 11->21         started        226 Query firmware table information (likely to detect VMs) 14->226 228 Changes security center settings (notifications, updates, antivirus, firewall) 17->228 signatures6 process7 dnsIp8 156 watira.xyz 21->156 158 127.0.0.1 unknown unknown 21->158 106 C:\Users\user\AppData\...\sahiba_9.exe (copy), PE32 21->106 dropped 108 C:\Users\user\AppData\...\sahiba_8.exe (copy), PE32 21->108 dropped 110 C:\Users\user\AppData\...\sahiba_7.exe (copy), PE32 21->110 dropped 112 6 other malicious files 21->112 dropped 220 Multi AV Scanner detection for dropped file 21->220 222 Detected unpacking (changes PE section rights) 21->222 224 Performs DNS queries to domains with low reputation 21->224 26 cmd.exe 1 21->26         started        28 cmd.exe 1 21->28         started        30 cmd.exe 1 21->30         started        32 8 other processes 21->32 file9 signatures10 process11 process12 34 sahiba_7.exe 26->34         started        39 sahiba_2.exe 28->39         started        41 sahiba_4.exe 2 30->41         started        43 sahiba_9.exe 32->43         started        45 sahiba_6.exe 32->45         started        47 sahiba_5.exe 2 32->47         started        49 3 other processes 32->49 dnsIp13 128 ipinfo.io 34->128 130 212.193.30.115, 49719, 80 SPD-NETTR Russian Federation 34->130 134 18 other IPs or domains 34->134 74 C:\Users\...\x2zxEHZ1DIhXz3lm96ihX0h4.exe, PE32 34->74 dropped 76 C:\Users\...\oZKQwrBhS5b5xVRBsq0abk6U.exe, PE32 34->76 dropped 78 C:\Users\...\eJ4y3FdoIEnwsQJAXqjXoKz_.exe, PE32 34->78 dropped 86 13 other malicious files 34->86 dropped 168 Drops PE files to the document folder of the user 34->168 170 May check the online IP address of the machine 34->170 172 Creates HTML files with .exe extension (expired dropper behavior) 34->172 188 2 other signatures 34->188 51 BSG6tBaNCRNvLs3yeCAU1lF6.exe 34->51         started        56 x2zxEHZ1DIhXz3lm96ihX0h4.exe 34->56         started        58 _FOhCwq5Xe5YzaFRFF7FV6rM.exe 34->58         started        66 2 other processes 34->66 174 Detected unpacking (changes PE section rights) 39->174 176 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 39->176 178 Maps a DLL or memory area into another process 39->178 190 2 other signatures 39->190 60 explorer.exe 39->60 injected 180 Obfuscated command line found 41->180 182 Performs DNS queries to domains with low reputation 41->182 192 2 other signatures 41->192 62 sahiba_4.exe 41->62         started        132 f.youtuuee.com 43->132 136 3 other IPs or domains 43->136 80 C:\Users\user\AppData\...\jfiag3g_gg.exe, PE32 43->80 dropped 68 8 other processes 43->68 138 2 other IPs or domains 45->138 82 C:\Users\user\AppData\Local\...\sahiba_5.tmp, PE32 47->82 dropped 64 sahiba_5.tmp 47->64         started        140 2 other IPs or domains 49->140 84 C:\Users\user\AppData\Local\...\sahiba_8.tmp, PE32 49->84 dropped 184 Detected unpacking (overwrites its own PE header) 49->184 70 2 other processes 49->70 file14 186 Tries to resolve many domain names, but no domain seems valid 132->186 signatures15 process16 dnsIp17 146 4 other IPs or domains 51->146 88 C:\Users\...\Fs8RcbiVLMBoHDHpyly_6dmI.exe, PE32 51->88 dropped 90 C:\Users\user\AppData\Local\...\WW14[1].exe, PE32 51->90 dropped 194 Multi AV Scanner detection for dropped file 51->194 196 Drops PE files to the document folder of the user 51->196 198 May check the online IP address of the machine 51->198 200 Creates HTML files with .exe extension (expired dropper behavior) 51->200 202 Detected unpacking (changes PE section rights) 56->202 204 Detected unpacking (overwrites its own PE header) 56->204 218 2 other signatures 58->218 148 7 other IPs or domains 60->148 92 C:\Users\user\AppData\Roaming\aierdae, PE32 60->92 dropped 206 System process connects to network (likely due to code injection or exploit) 60->206 208 Benign windows process drops PE files 60->208 210 Hides that the sample has been downloaded from the Internet (zone.identifier) 60->210 150 2 other IPs or domains 62->150 142 requested404.com 64->142 94 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 64->94 dropped 104 2 other files (none is malicious) 64->104 dropped 152 5 other IPs or domains 66->152 96 C:\Users\...\eJ4y3FdoIEnwsQJAXqjXoKz_.tmp, PE32 66->96 dropped 212 Tries to harvest and steal browser information (history, passwords, etc) 66->212 144 live.goatgame.live 70->144 154 2 other IPs or domains 70->154 98 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 70->98 dropped 100 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 70->100 dropped 102 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 70->102 dropped 72 conhost.exe 70->72         started        file18 214 Performs DNS queries to domains with low reputation 144->214 216 Tries to resolve many domain names, but no domain seems valid 144->216 signatures19 process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818/
Threat name:
Win32.Packed.Confuser
Create hunting rule
Status:
Malicious
First seen:
2021-07-31 11:10:49 UTC
File Type:
PE (Exe)
Extracted files:
172
AV detection:
28 of 38 (73.68%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3sas7inondp2af6p3yti4kxfemazgcfrak6oblfrmvwarm2nzama._file
Verdict:
malicious
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:fabookie family:nullmixer family:privateloader family:redline family:sectoprat family:smokeloader family:vidar botnet:706 botnet:aniold aspackv2 backdoor dropper evasion infostealer loader rat spyware stealer trojan upx
Link:
https://tria.ge/reports/230204-3et5gafa93/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
ASPack v2.12-2.42
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
UPX packed file
Nirsoft
Vidar Stealer
Detect Fabookie payload
Detects Smokeloader packer
Fabookie
Modifies Windows Defender Real-time Protection settings
NullMixer
PrivateLoader
RedLine
RedLine payload
SectopRAT
SectopRAT payload
SmokeLoader
Vidar
Malware Config
C2 Extraction:
http://watira.xyz/
liezaphare.xyz:80
https://xeronxikxxx.tumblr.com/
Unpacked files
SH256 hash:
0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498
MD5 hash:
cc0d6b6813f92dbf5be3ecacf44d662a
SHA1 hash:
b968c57a14ddada4128356f6e39fb66c6d864d3f
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
55361941ab12c7edd987c706d25423d868f756fab1028d99eeffacdabf3da4ca
MD5 hash:
4de4b7bc0a92902422c4204fcfa58150
SHA1 hash:
587e0299ea32cc836281998941daa60f471e3480
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
40ca14be87ccee1c66cce8ce07d7ed9b94a0f7b46d84f9147c4bbf6ddab75a67
MD5 hash:
7165e9d7456520d1f1644aa26da7c423
SHA1 hash:
177f9116229a021e24f80c4059999c4c52f9e830
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
ff5b7e9a2d5af436c13951d0746015237e3b12f4d4dc845a92b4e430c098e224
MD5 hash:
8ecc287212bb08f80f80c4ec1a7c6c4c
SHA1 hash:
59d08bda2e494600ed25fd608582b25261ec13b0
Detections:
win_vidar_auto
Create hunting rule
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
Parent samples :
7fa24025283e6b745f20c81e15a8cdb866905fb079579b71efd9e659398cb574
65341b1f7f4018e163e564b546012d5bfa41a70c9b9926a0b48781ae4e3f9ec3
d3de52ec5e00eff831e15a2719c702f98fbcf95183849dea98d1483c6f171446
7140765cd0d5f61bb453f0511e24786e21d950c2cb3b30aa2945ba1846a4e0a5
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
SH256 hash:
4a013358eb6de187261c006032f6d518539b6ecc63962bdb8b141de9cbfd5df7
MD5 hash:
d10576b82d2714ac45e0fc89ed6938dc
SHA1 hash:
75d55f17835bd3a454115c8db10a80a515cb0cea
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
3e3a5961f6d5ca586d7f2ef0830eea16f168ab0e8b63d281ffc12a27dcbfde9b
MD5 hash:
126799c774eaab2387fe39eb5d4fcef0
SHA1 hash:
1eb68d48d8ae2829d2bb498e3ec1274ddc91e11c
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
a44daa993632ffb1fb4a1faf7b290318d07bb242a081230578e67fcba57615ba
MD5 hash:
668960d5d4afb0024cb967cf6b495673
SHA1 hash:
14ca4cdbd4a07d0fac894c0f3f01c9ab5d2d50d0
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
edd2a0334bfcf63a8c9b9d3a148fd6ad7f76a757ea56589b0670cb72d7dce6ff
MD5 hash:
ad6992e6f028f1f9cd8714ad4cf5313e
SHA1 hash:
f837082d106727a30ff849ed3838da6cfdd4b29c
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
207056003b4b6e55dfe2557a2d1ca119c7785cfe626328a4a8c74323238933e9
MD5 hash:
4955a27a03f35933fdbd801f425b6c58
SHA1 hash:
97f3b8f33fd1a49cf9db5a246d996047beef3c12
Detections:
win_smokeloader_a2
Create hunting rule
SmokeLoaderStage2
Create hunting rule
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
Parent samples :
db50d646494970b78887d4d84f52147c4cdbaa0b23cb4eb330ffa2403735937c
f1e1b516a83f303659e53d513c9c3da9dfd466f40b96f8de86ca37ce9544d234
d3de52ec5e00eff831e15a2719c702f98fbcf95183849dea98d1483c6f171446
7140765cd0d5f61bb453f0511e24786e21d950c2cb3b30aa2945ba1846a4e0a5
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
93ac84d519edb6350cf53736449330985fe1cb52eff043857daf6cca916d6fa3
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
269d2ae2661789f8929d934a7f7e44b6d6fa2e2fc3799fd53b44988aed906b1f
SH256 hash:
64dcc8dea7aae1a262ad38bbf554db3fbfd28d1852f489fab8a5bdb117e58205
MD5 hash:
2ee6b800326d0207b521b7f95140eb11
SHA1 hash:
011db5f3702750d1cc003f3e02c5737e1184ef25
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
7d7d5ae0fa9286fea65a6f94240389998ff0d08340a2aedc67ef3547e84d64c6
MD5 hash:
270dd1da0ab7f38cdff6fab84562ec7a
SHA1 hash:
cf7be169ee4415085baeb4aeaa60932ac5abf4ac
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
4df50c6d6d188c3413bdba53851cbeea7b281b92b0d5341c021a65912395fa5b
MD5 hash:
3011f2257b899aa8196e02447383a46b
SHA1 hash:
cb90ff25622aa5e5e20e257f6c6cb3ce58bd6940
Detections:
PrivateLoader
Create hunting rule
win_privateloader_w0
Create hunting rule
win_privateloader_a0
Create hunting rule
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
Parent samples :
d3de52ec5e00eff831e15a2719c702f98fbcf95183849dea98d1483c6f171446
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
SH256 hash:
5e48fa65285cf78077e7a4838db4988d42052bc3b2f62b81f3817794d1332b03
MD5 hash:
a31b7fd74f673785c4f0101409def34b
SHA1 hash:
4d3c9403c5659c1a7a31dc7b8612b2886ed6da6c
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
da72fa2ad767e22db3d55506846b5d4db7932cd7287391c483faa80c5e86bcce
MD5 hash:
eb73f48eaf544bf7e035a58f95f73394
SHA1 hash:
251f0d09f14452538ecfa0924a4618c3c16887e3
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
MD5 hash:
c0d18a829910babf695b4fdaea21a047
SHA1 hash:
236a19746fe1a1063ebe077c8a0553566f92ef0f
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
7e1282097df8513b7a380803f31386373c178bb97102862d6a08816c0a8902f4
MD5 hash:
4fa4a626bfe65bbb3ba048e66170556a
SHA1 hash:
05e0beeedc4a183056292c36cc87a9822f3a19af
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
e427f8ef21691e3d8c2313d11129ad08ddef69a158eca2f77c170603478ff0c4
MD5 hash:
0dedd909aae9aa0a89b4422106310e9e
SHA1 hash:
271d36afa5b729ee590cf8066166ca5e9c9d0340
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
b1415dbaffccaa297516e28ae4b3dcd27ed8ad27cf0a21f06445aaa1e8433d27
MD5 hash:
0207e2ac547b2d547fe7a160e93fc36e
SHA1 hash:
a75f1dae564fd7981204852d1a78b783a2e803f9
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
SH256 hash:
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
MD5 hash:
937768008be3b71478be77f512943a75
SHA1 hash:
be2c1470c46eb18c49500dd5bb07a7cabe588398
Link:
https://www.unpac.me/results/815644e9-4e47-4143-96a2-2a72f5eeb916/
Malware family:
RedLine.A
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dc812fa1ae68/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Mal_InfoStealer_Win32_RedLine_Unobfuscated_2021
Create hunting rule
Author:BlackBerry Threat Research Team
Description:Detects Unobfuscated RedLine Infostealer Executables (.NET)
Rule name:pe_imphash
Create hunting rule
Rule name:Redline32
Create hunting rule
Author:Muffin
Description:This rule detects Redline Stealer
Rule name:RedLine_a
Create hunting rule
Author:@bartblaze
Description:Identifies RedLine stealer.
Rule name:redline_new_bin
Create hunting rule
Author:James_inthe_box
Description:Redline stealer
Reference:https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:RedOctoberPluginCollectInfo
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_RedLineStealer_f54632eb
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Vidar_114258d5
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Vidar_9007feb2
Create hunting rule
Author:Elastic Security
Rule name:win_vidar_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.vidar.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/360310/

Comments