MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6e43abf63a28725b10b89c1351e85ae417981d372b450fd81b05ec655c0a252. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f6e43abf63a28725b10b89c1351e85ae417981d372b450fd81b05ec655c0a252
SHA3-384 hash:	1fae9de6de2d670ea05571b0ed780f794127f482c2d838660207c25951f3e93880ce22d4a1d4073348858eb987b41aef
SHA1 hash:	fc690b2739bdcb4a78129eb5a47a69453cc686c5
MD5 hash:	a6dca7289a74b575025a6553e973491b
humanhash:	white-west-alabama-social
File name:	f6e43abf63a28725b10b89c1351e85ae417981d372b450fd81b05ec655c0a252
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	1'173'504 bytes
First seen:	2023-05-14 18:39:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep	24576:By/h4WsNjMGJ9qiL/apHrYvjF8WQCkjQtunsz+ozZI+:0yWs2EjL/axrcjF8W/k4bzZ
TLSH	T191452307AFC58073E9B50B7478F707470A3E7CD0A924872A33865E9B09F3694A5B3766
TrID	70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 3.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):
dhash icon	f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter	JaffaCakes118
Tags:	RedLineStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

56

Origin country :

GB

Vendor Threat Intelligence

ANY.RUN redline

Malware family:

redline

Alert

Create hunting rule

ID:

1

File name:

f6e43abf63a28725b10b89c1351e85ae417981d372b450fd81b05ec655c0a252

Verdict:

Malicious activity

Analysis date:

2023-05-14 20:17:07 UTC

Tags:

rat redline trojan amadey loader

Link:

https://app.any.run/tasks/779d82f3-3643-4b25-90d3-86a4c6e48205

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox RedLine

Detection:

RedLine

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/389775/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28840.BadO.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Launching a service

Creating a file

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a window

Blocking the Windows Defender launch

Disabling the operating system update service

Unauthorized injection to a recently created process

Sending a TCP request to an infection source

Stealing user critical data

Unauthorized injection to a recently created process by context flags manipulation

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

advpack.dll CAB confuserex installer packed packed rundll32.exe setupapi.dll shell32.dll

Link:

https://www.filescan.io/uploads/64612b22c91c7e59599bc417/reports/a11ac2b4-1feb-40fa-98f2-997b2ac28e85/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/f6e43abf63a28725b10b89c1351e85ae417981d372b450fd81b05ec655c0a252

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer RedLine stealer

Malware family:

RedLine stealer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b2f91c9b-e163-411f-b82e-fb9a85fce2de

Joe Sandbox RedLine

Result

Threat name:

RedLine

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1233003

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f6e43abf63a28725b10b89c1351e85ae417981d372b450fd81b05ec655c0a252/

ReversingLabs TitaniumCloud Win32.Trojan.RedLineStealer

Threat name:

Win32.Trojan.RedLineStealer

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-13 15:39:25 UTC

File Type:

PE (Exe)

Extracted files:

115

AV detection:

29 of 37 (78.38%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=63sdvp3dukdslmilrhatkhufvzaxtaotok2fb7mbwbpmmvoaujja._file

Hatching Triage redline

Result

Malware family:

redline

Alert

Create hunting rule

Score:

  10/10

Tags:

family:redline botnet:miran botnet:raven discovery evasion infostealer persistence spyware stealer trojan

Link:

https://tria.ge/reports/230514-xa39padb53/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Modifies Windows Defender Real-time Protection settings

RedLine

Malware Config

C2 Extraction:

185.161.248.75:4132

UnpacMe redline

Unpacked files

SH256 hash:

f09c3920ba074df136ee1f196c204113f76213443fcc70b8074bd6ea5d92bd71

MD5 hash:

ca1b5c6178e9faa5d067f2fbb1461ec7

SHA1 hash:

e0869a1e51047796e25495f6811b0db21d2941fe

Link:

https://www.unpac.me/results/1e9e95ba-2d4c-4634-92cb-6fc6293e0849/

SH256 hash:

c2d5c4e48614ee87eaa5d9c1912b4dd7c205b1537c34a7efeb7a9c58a2851e0e

MD5 hash:

00276eb7a675e1b5f0a976bd6e0c19d1

SHA1 hash:

07281cd1606a6e316f05c18a57818cc9e5e7b739

Link:

https://www.unpac.me/results/1e9e95ba-2d4c-4634-92cb-6fc6293e0849/

SH256 hash:

944cf47fa2935e6902ff0f2ebd1d1a80637c32453a005c5a49932c82e2f644e9

MD5 hash:

a2a5dd0a0c60f667c37131a2c1969679

SHA1 hash:

9a239d7022202059eaf2c8ec4cef8af07bfb6841

Detections:

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/1e9e95ba-2d4c-4634-92cb-6fc6293e0849/

Parent samples :

17c3b4a77181d9fec2839f539f37f5828774edc7ce334f8b14ed4a400624bd62
2a8b129852665480672fdc9383c03bb4359b33c3c3b058aa9f503410ab8c8b8a
ba401da0d62d69b098447b5a07772436f599269929429a61f9a85f6857a66ab0
bcdc70c860f3772af96cbf35f4f33e04540489c86fbfbcf9c1df8fb2b0f10daa
bfa12b1c6e5f3c58b25ab7463050c395c92123ed5a282e8b37f2d600a8ad4adb
c30b4fb833c6e6c5cc0307e82746de060e08980c10d9113fbcf16324ed43841f
d1d0f16a62ef41e98a1dc2c65953c623a01e5e12ee7a6bdbed8a1ad25e188c64
d7d08809eeaaa72b382638d6facf28eac7c31e9fa7b385285784929c8fbb8aa6
d8fc27a3a73f3add555c9e6e63fa933e72038548af1e341323c3d7569e48636f
dcfa688395b63f54f26bb2d6df4bbdac7fbacd7a29f6abee3c03233119846a2e
dfa50aec7acb8553aedf43e2ab3dcc1b226895326d631de2acd1714b89d53794
e2b2664bc1ae0bc34326e2a4bd6b4699afe2401c8ef72858e1dc9c21972cdbf0
e4e4cb6303b8e4b7f52439a5fd470d1d362850b4cfe0491af1152c89f70bf0c6
ea7ab7d36e5120a8a3f25e0a9a4b87c28f535c7ca3d1f34f05bc188d8a6c44df
eeed49d3b75a71792b11ed9e714e0d9dd0730336811ca26f8ac9c742d548a15e
f00ef46391f8c6228eac11439ab8020d8111bcde4944978eddc89952663125bc
f3d6748b88f45598e4db85b3d2bd9c98532da20152703d50f74619354ab997ab
f6e43abf63a28725b10b89c1351e85ae417981d372b450fd81b05ec655c0a252
fb22147ec9bdac2010950c88bb5253729eab2fccaea5761c290aac89aefc3893
ffcdbeb2750ad3f9e667de2c513c025a2e5920af2677bcebc9d09d7f694e7731

SH256 hash:

4dbf7104a68cf3712824e924a0a69fd24b4a3b6704a509e3c17b18b26e3eb2cc

MD5 hash:

1add826fe31fbb76b4659d74f81e343b

SHA1 hash:

82a5d4f1f6d7119773b9ec03e2722c79edc56668

Link:

https://www.unpac.me/results/1e9e95ba-2d4c-4634-92cb-6fc6293e0849/

SH256 hash:

050d18ea98747dc199b7fae592cad46e43d83212e46ef6fb8459f1dc376dc020

MD5 hash:

a3df53244353247e8089e0abe89cf376

SHA1 hash:

3fed5a12ce8f1b1cfcc883917f67d6a2a052ab4e

Link:

https://www.unpac.me/results/1e9e95ba-2d4c-4634-92cb-6fc6293e0849/

SH256 hash:

978acfba08d6f13da0aeb06dbe9452a5f4eec9121be84a9757efffde8498980b

MD5 hash:

68c9a7c0bdf687e7d8f09144837ac1d9

SHA1 hash:

c727f4593b92a26e74107104c15315b319f7d152

Link:

https://www.unpac.me/results/1e9e95ba-2d4c-4634-92cb-6fc6293e0849/

SH256 hash:

f6e43abf63a28725b10b89c1351e85ae417981d372b450fd81b05ec655c0a252

MD5 hash:

a6dca7289a74b575025a6553e973491b

SHA1 hash:

fc690b2739bdcb4a78129eb5a47a69453cc686c5

Link:

https://www.unpac.me/results/1e9e95ba-2d4c-4634-92cb-6fc6293e0849/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Redline

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f6e43abf63a28725b10b89c1351e85ae417981d372b450fd81b05ec655c0a252

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/389775/