MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f80b860277228e7b418a2d2bed4b4de229bc6ca7010075919b8ad7f299334022. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f80b860277228e7b418a2d2bed4b4de229bc6ca7010075919b8ad7f299334022
SHA3-384 hash:	868923417c454082c55f5c0c30cf35a237503ec109052d551b6b790dd540376a859c343658a2963320bf2e7ce62fc959
SHA1 hash:	a6f3d575ded22535672a5cfd3ea67e67adcc2fb7
MD5 hash:	f97843ce5d1e4dc01426c3136478afb1
humanhash:	sweet-shade-robin-yankee
File name:	f80b860277228e7b418a2d2bed4b4de229bc6ca7010075919b8ad7f299334022
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	894'464 bytes
First seen:	2023-05-14 18:39:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep	24576:pyytbfL1+8TRNIBJE5LaVoqE2RFnpr4Eo8jVz3Ua:cytbfLM8TfI7E5KoqE8FJPo
TLSH	T150152362EAE8A076D8F71BB594F743430B35BDB28CB5962B37929C8C1D72984353131B
TrID	70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 3.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):
dhash icon	f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter	JaffaCakes118
Tags:	RedLineStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

57

Origin country :

GB

Vendor Threat Intelligence

ANY.RUN redline

Malware family:

redline

Alert

Create hunting rule

ID:

1

File name:

f80b860277228e7b418a2d2bed4b4de229bc6ca7010075919b8ad7f299334022

Verdict:

Malicious activity

Analysis date:

2023-05-14 20:12:58 UTC

Tags:

rat redline trojan amadey loader

Link:

https://app.any.run/tasks/8a75e513-7774-43bb-b17c-017ae9f6fe88

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox RedLine

Detection:

RedLine

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/389777/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28840.BadO.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Launching a service

Creating a file

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a window

Blocking the Windows Defender launch

Disabling the operating system update service

Unauthorized injection to a recently created process

Sending a TCP request to an infection source

Stealing user critical data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

advpack.dll anti-vm CAB confuserex installer packed packed rundll32.exe setupapi.dll shell32.dll

Link:

https://www.filescan.io/uploads/64612b24f571536d031159ad/reports/75afd58e-2961-4deb-871c-5c4e199a6ee8/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/f80b860277228e7b418a2d2bed4b4de229bc6ca7010075919b8ad7f299334022

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer RedLine stealer

Malware family:

RedLine stealer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/273c2f42-fefe-4919-ac8f-c9958bfabfda

Joe Sandbox Amadey, RedLine

Result

Threat name:

Amadey, RedLine

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1233001

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f80b860277228e7b418a2d2bed4b4de229bc6ca7010075919b8ad7f299334022/

ReversingLabs TitaniumCloud Win32.Trojan.AgentTesla

Threat name:

Win32.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-14 18:41:38 UTC

File Type:

PE (Exe)

Extracted files:

116

AV detection:

20 of 24 (83.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7afymatxekhhwqmkfuv62s2n4iu3y3fhaeahlem3rll7fgjtiara._file

Hatching Triage redline

Result

Malware family:

redline

Alert

Create hunting rule

Score:

  10/10

Tags:

family:redline botnet:jamba botnet:mizer discovery evasion infostealer persistence spyware stealer trojan

Link:

https://tria.ge/reports/230514-xa4kfsdb55/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Modifies Windows Defender Real-time Protection settings

RedLine

Malware Config

C2 Extraction:

185.161.248.75:4132

UnpacMe redline Amadey

Unpacked files

SH256 hash:

23537d6316fd5419fe71f28761ac2118afff65f56ab66e203933366c371bc026

MD5 hash:

6f844271adcbf206112e1cba5aab4fd7

SHA1 hash:

e362bdf36a18cd4f1fdf64b3c098388a246feca1

Link:

https://www.unpac.me/results/3efe24ee-2381-48af-a492-a26c993dcf6d/

SH256 hash:

296ac9463a2dacb2e14099d4306317b38993b26335b9f4c6e2a272d94936e905

MD5 hash:

1a0efadbb446c51c39029d46ad815f85

SHA1 hash:

207473f13c69f0dc0c1d20f3422e556882d2d0de

Link:

https://www.unpac.me/results/3efe24ee-2381-48af-a492-a26c993dcf6d/

SH256 hash:

17118740cd6cdfb7475c15c1877398cfbe76e33c8153ea3bd2a740268ea11f6c

MD5 hash:

3a22f37325e6331cba5a79e95b0537ac

SHA1 hash:

f85fe334977970d71c628a78746a21442d9913fe

Detections:

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/3efe24ee-2381-48af-a492-a26c993dcf6d/

Parent samples :

f3a684723b36c12c93a37daf6d69c61d41c38597ab27e11900815c80c3e956e6
69f067926ac6ffb5670a1d6cd750113a86df4ad5f742f4f728d4a91b6d3f6713
d14ef1de1be18c0fc8c9d3c9f99214d1fdd6d529da03b27310660e00a2f26c33
d1e0b6ef31d08705ebc0beca7afdda064a188817f7baedebf1073bca6cfa1dc9
d3c7805bb7ea281f396339fe84e989b2d53171ef009f9b1752e19feef9c1d47e
d3dbbfb1c3b3f7c253db6162e085b2bfd104ef175c582ec0a5b787d02351e676
d4e8984139d173b84ee48092b0798b52101aab31fa9047bdfd1e511c4a6082bc
f51878167ae4cd958467b28db0abf66b2c021447bfd76a6ca629be87d0598040
f80b860277228e7b418a2d2bed4b4de229bc6ca7010075919b8ad7f299334022

SH256 hash:

35b778aba27ab5ddcdd69b5869eac3b2a53f380ea75fdfd4821e1c3e9ed60243

MD5 hash:

6172dd865ec5e057fb5e85d53d8d8607

SHA1 hash:

6ea29a0113f36197d41ec7090287ffe216f8ef6b

Link:

https://www.unpac.me/results/3efe24ee-2381-48af-a492-a26c993dcf6d/

SH256 hash:

e7dc61c9f1fe0d4e056c5d1cdbcd8bb99fb5a87640ac77e1ab4302f9c31a432f

MD5 hash:

4eba8755ada46a845b2a8540fc01abd6

SHA1 hash:

579eaab00cdc3c624557e95f4342037f92dd28c0

Detections:

Amadey

Alert

Create hunting rule

Link:

https://www.unpac.me/results/3efe24ee-2381-48af-a492-a26c993dcf6d/

Parent samples :

cb443e8a6ccb80a2163829599a4ec76cb702292475d0b5c41a4b49ed0b8a9c71
d3c7805bb7ea281f396339fe84e989b2d53171ef009f9b1752e19feef9c1d47e
d91f57441261b037611da6c2820c9ff467675fb4e04b8a550409c99e93970ff5
e1a9bbaee7fed9154443855980be42650aa3cb040803db7d7335348caf47d1e1
f3052d51a87302468969120c438441c758440d11e133cc84dd714c10eab3ba95
f80b860277228e7b418a2d2bed4b4de229bc6ca7010075919b8ad7f299334022

SH256 hash:

3b83837f015c33e69e85c8d6c315debbce7f659cb76702ba17ae3e82b64c43f9

MD5 hash:

f1ce8620ad976e5cffd0d613e8bc62e1

SHA1 hash:

0bde8fcc04e46920004065513d8f8fae9a1d448e

Link:

https://www.unpac.me/results/3efe24ee-2381-48af-a492-a26c993dcf6d/

SH256 hash:

f80b860277228e7b418a2d2bed4b4de229bc6ca7010075919b8ad7f299334022

MD5 hash:

f97843ce5d1e4dc01426c3136478afb1

SHA1 hash:

a6f3d575ded22535672a5cfd3ea67e67adcc2fb7

Link:

https://www.unpac.me/results/3efe24ee-2381-48af-a492-a26c993dcf6d/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Redline

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f80b860277228e7b418a2d2bed4b4de229bc6ca7010075919b8ad7f299334022

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/389777/