MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e169389f93b1c80752ff3a8e38cab5751d48269a2a13318ffec1e8e19e91d56c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e169389f93b1c80752ff3a8e38cab5751d48269a2a13318ffec1e8e19e91d56c
SHA3-384 hash: 2d0d4fe3e07ee53bdd2760e1fd8fbb98d3671d71fe327e9f88fd605f906dde24e197ee4311d1bc9b20a8ac9eb43f796d
SHA1 hash: d1da0dd98222b62d510a57af994c060bb2d1ecd2
MD5 hash: c6626f7bef89248607e29afb17fcce9c
humanhash: seven-comet-jupiter-magnesium
File name:c6626f7bef89248607e29afb17fcce9c.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:376'832 bytes
First seen:2021-12-05 08:17:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1b81e8f7d77881f7dbd36488c7ba26dc (17 x RedLineStealer, 5 x RaccoonStealer, 2 x CryptBot)
ssdeep 6144:IXVYu5+cV0HzK8QE3/zVrqj+od0Dssnt6+896hJgLxCY7gEqur7:IXVYu5tiG8QE3Fq6o25s/Q/gLxCxE1
Threatray 4'557 similar samples on MalwareBazaar
TLSH T1BB84CF1272C0C032C19765768926CBB15ABAB4745A726ACF7FD90BBC5F247C1A73230E
File icon (PE):PE icon
dhash icon d2b1e4d4ecb9c7f9 (6 x Smoke Loader, 6 x Stealc, 5 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
253
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c6626f7bef89248607e29afb17fcce9c.exe
Verdict:
Malicious activity
Analysis date:
2021-12-05 08:19:02 UTC
Tags:
evasion
Link:
https://app.any.run/tasks/dfa142bc-69c9-475b-b123-53ea0f10d341

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/211442/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/888/overview
Behaviour
CPUID_Instruction
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61ac75bdfa72c81b5b0c5db7/reports/8f9b1ffd-860e-476f-b86d-e86c7b1954f1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
STOP Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/654c761b-6e18-40bb-bd25-1ab389cfb8ef
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/901644
Signature
Antivirus detection for URL or domain
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e169389f93b1c80752ff3a8e38cab5751d48269a2a13318ffec1e8e19e91d56c/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2021-12-05 01:59:06 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
067c807a07a5a2aa8ee58f79bf846aa4b8c590dffa51f1525a1cfd5a63392557
RedLineStealer
0d054d4b3068ea7f877963a9be8a71581cb0396a309f65e0a95a45ac1e758d62
RedLineStealer
136b09653c55e04d3c4162c116bebb52dc337d62cdd69e2f0977fbc17e69dfd0
RedLineStealer
2f5ea90c14a9eff6482a7c7c020b9a65faebf7a98af718a1e3c9a3b2356eb509
RedLineStealer
4af6c10f95107cb0721dc162cc6e3f13ec9fc8e50ab7aba4a3f3a7a40fe36826
RedLineStealer
bc2cce5055f9411c04edeee699d7161c257574b4c5540351b647d8a52de9540c
RedLineStealer
c7304ff0966068d305da031f9da60c5b0ebe32ac43533d27f50190f1ba549347
RedLineStealer
ec75d2e78898eef0f85ec90d16989cf9c1fb5f1e0f7b45cddad67192846aa8da
RedLineStealer
+ 4'547 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/211205-j7afzscbgn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
.NET Reactor proctector
Unpacked files
SH256 hash:
caf54dc494727a499cdc9fff3750d2ca4ce88f5e527e8804f6e3bde3418531ae
MD5 hash:
d2b113ae8b2997e0ca7deb4b4c1718eb
SHA1 hash:
e967fc9b7f5962c6ebc7bc85f0960a9ef76c63bd
Link:
https://www.unpac.me/results/c42c99e8-8dd5-4df9-bb17-1360f65ad49d/
SH256 hash:
f80180b8a2c89c47caf095c47140ccc4637f78fc9b8d13aef0efe48544bef85b
MD5 hash:
f7ed2321a7dfde87f1a0f47a20fd1977
SHA1 hash:
6b0b16c2743c1b08c663b9bce10a935e2b22e1fd
Link:
https://www.unpac.me/results/c42c99e8-8dd5-4df9-bb17-1360f65ad49d/
SH256 hash:
3722601539dc78129748847c8156cfa525674af34ef106cd38e1a7ab4c2b6cdb
MD5 hash:
8f9488c5270fadb17cdc0afe271cd7b2
SHA1 hash:
174d03856b530aec0df464046fed844c1d386b49
Link:
https://www.unpac.me/results/c42c99e8-8dd5-4df9-bb17-1360f65ad49d/
SH256 hash:
e169389f93b1c80752ff3a8e38cab5751d48269a2a13318ffec1e8e19e91d56c
MD5 hash:
c6626f7bef89248607e29afb17fcce9c
SHA1 hash:
d1da0dd98222b62d510a57af994c060bb2d1ecd2
Link:
https://www.unpac.me/results/c42c99e8-8dd5-4df9-bb17-1360f65ad49d/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e169389f93b1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e169389f93b1c80752ff3a8e38cab5751d48269a2a13318ffec1e8e19e91d56c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe e169389f93b1c80752ff3a8e38cab5751d48269a2a13318ffec1e8e19e91d56c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1842233/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/211442/

Comments