MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8ee3601067ef801d52e9348435b6462b8e1b6aa28bf5d375b344a67077d89f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8ee3601067ef801d52e9348435b6462b8e1b6aa28bf5d375b344a67077d89f9
SHA3-384 hash: eeef8bfcc0125bf54c25a12e4b5be34a15c6285dad7bd3abfeba13821f03cbb7927c3fb5a129a524e4b03dfe88ee8bc9
SHA1 hash: 9c95c7f7580cff7b962c2f3c72f6e1c9dd8b668b
MD5 hash: 941f1718a6925b8791e13ff2d029a3fd
humanhash: pizza-emma-red-fix
File name:68546605.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:402'432 bytes
First seen:2023-05-13 22:44:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 10cfe9ee407d992148ea4447813a105f (2 x RedLineStealer)
ssdeep 6144:+buV7Jj4Rm7txAs3NKkea/h0gKT1gKZt/vGdafqA:+bu5Jj4sBxhK5EhRwd/v7
Threatray 24 similar samples on MalwareBazaar
TLSH T1D4849D5362F07833E63246328E2EC6F46A5EF9614F15BBDB2354DA2F09B21E2C176711
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 116a6e6a6a6a6a60 (6 x Rhadamanthys, 6 x Smoke Loader, 6 x RedLineStealer)
Reporter JaffaCakes118
Tags:RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
68546605.exe
Verdict:
No threats detected
Analysis date:
2023-05-13 22:48:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/11fd3c1e-f377-4a31-8aae-59d97ad4d009

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/388970/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a service
Creating a file
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Blocking the Windows Defender launch
Disabling the operating system update service
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware lockbit packed
Link:
https://www.filescan.io/uploads/646012f03f7b24f3bbefa987/reports/abaf9b49-e33b-4b9f-a4c0-59dc596fa4af/overview
Verdict:
Malicious
Labled as:
Trojan.Zenpak
Link:
https://www.hybrid-analysis.com/sample/e8ee3601067ef801d52e9348435b6462b8e1b6aa28bf5d375b344a67077d89f9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ceb923e1-7aa3-4923-870c-2401f9ab3d84
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1232638
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8ee3601067ef801d52e9348435b6462b8e1b6aa28bf5d375b344a67077d89f9/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-04-30 05:05:09 UTC
File Type:
PE (Exe)
Extracted files:
42
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5dxdmaigp34advjosneegw3emk4odnvkfc7v2n23grfgob35rh4q._file
Verdict:
malicious
Similar samples:
00062cb01088cea245cd5f3eb03f65a0e6b11a8126ce00034d87935a451cf99c
RedLineStealer
482211794587f7985f0027197ed0b69969d062034f6b1fdf67d563c27885871e
RedLineStealer
6d7ea4c30059878e650cf86cb44fb644dc1e46329f1f4031f50cd6b05346f3d6
RedLineStealer
737b37ca53014d7685fd7f20c8b8e704b550835203598dcc3882fec5a88924c0
RedLineStealer
81146d49bf015b9202eb30a45d224553f08ec936b25d5e3d21b4ad611b36d112
RedLineStealer
878ec26100fae85a47ead5efd4c2a3e8b87ed4d216bb61db244f902d609592d9
RedLineStealer
c154a961ac8e784a6a42aec1733a6e7c0287958fc27f500f4341dfa4d763556d
RedLineStealer
c3839b633f21352702166f574f09962974fc30bbae72fb8ec0557c8c89a3342a
RedLineStealer
dbb85aad99b7c16233015e2672a5bbcb3c21858652ff72e781766c0851d78d32
RedLineStealer
f142e6624dde6b1f4fb8b997e4ccb7d0deeb30955422befe3f4ea54a80c920e8
RedLineStealer
+ 14 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion trojan
Link:
https://tria.ge/reports/230513-2pebbshe85/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Windows security modification
Modifies Windows Defender Real-time Protection settings
Gathering data
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e8ee3601067e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e8ee3601067ef801d52e9348435b6462b8e1b6aa28bf5d375b344a67077d89f9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/388970/

Comments