MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f81da8996e34359d2d78929ffc5cf829eb102f92676960936f42bcfcf6085a8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Amadey


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f81da8996e34359d2d78929ffc5cf829eb102f92676960936f42bcfcf6085a8c
SHA3-384 hash: 14029388b8a3918a7fcba39bde855550156fdd1116019c8c07896c63fb12140d2ae441f5c06ac1b36a6b729c54c2f21a
SHA1 hash: e3d72a3dd3e82fc1aeee07a4954485c6a71610e1
MD5 hash: 72d8d55daaaea363d2202ce5fb503b1e
humanhash: chicken-cold-robin-finch
File name:f81da8996e34359d2d78929ffc5cf829eb102f9267696.exe
Download: download sample
Signature Amadey
Create hunting rule
File size:1'364'992 bytes
First seen:2023-09-06 22:46:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 24576:+yS0lf5x1ayTDHmx2AtuXcwYiDta+CbVeJF6seA/2kXjhPuTY:NSsrlPgLwb3PeLkX8
Threatray 1'863 similar samples on MalwareBazaar
TLSH T18D55234797F09172F4B10B70A4F607930B377C618D65A37F36A6688A1E722C68A3537B
TrID 70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:Amadey exe


Avatar
abuse_ch
Amadey C2:
http://77.91.68.52/mac/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
291
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
f81da8996e34359d2d78929ffc5cf829eb102f9267696.exe
Verdict:
Malicious activity
Analysis date:
2023-09-06 22:46:47 UTC
Tags:
stealc stealer redline amadey botnet trojan opendir loader
Link:
https://app.any.run/tasks/f50cbab6-34b6-4eff-9dbf-c06a7f1cb8fe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/446768/
Detection(s):
Sanesecurity.Malware.28840.BadO.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Сreating synchronization primitives
Creating a file
Sending a custom TCP request
Launching a process
Launching cmd.exe command interpreter
Connecting to a non-recommended domain
Sending an HTTP POST request
Adding an access-denied ACE
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Sending a TCP request to an infection source
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Labled as:
Crifi.Generic
Link:
https://www.hybrid-analysis.com/sample/f81da8996e34359d2d78929ffc5cf829eb102f92676960936f42bcfcf6085a8c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f59808e3-d271-4bc7-9374-469732c5d07c
Result
Threat name:
Amadey, Mystic Stealer, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1304783
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Creates an undocumented autostart registry key
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Amadey bot
Yara detected Amadeys Clipper DLL
Yara detected Amadeys stealer DLL
Yara detected Mystic Stealer
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1304783 Sample: f81da8996e34359d2d78929ffc5... Startdate: 07/09/2023 Architecture: WINDOWS Score: 100 146 Snort IDS alert for network traffic 2->146 148 Found malware configuration 2->148 150 Malicious sample detected (through community Yara rule) 2->150 152 14 other signatures 2->152 13 f81da8996e34359d2d78929ffc5cf829eb102f9267696.exe 1 4 2->13         started        16 explonde.exe 2->16         started        18 rundll32.exe 2->18         started        20 5 other processes 2->20 process3 file4 126 C:\Users\user\AppData\Local\...\y9474159.exe, PE32 13->126 dropped 128 C:\Users\user\AppData\Local\...\p4560654.exe, PE32+ 13->128 dropped 22 y9474159.exe 1 4 13->22         started        process5 file6 104 C:\Users\user\AppData\Local\...\y4769040.exe, PE32 22->104 dropped 106 C:\Users\user\AppData\Local\...\o4874719.exe, PE32 22->106 dropped 170 Antivirus detection for dropped file 22->170 172 Multi AV Scanner detection for dropped file 22->172 174 Machine Learning detection for dropped file 22->174 26 o4874719.exe 22->26         started        30 y4769040.exe 1 4 22->30         started        signatures7 process8 file9 114 C:\Users\user\AppData\Local\...\z1345504.exe, PE32 26->114 dropped 116 C:\Users\user\AppData\Local\...\w7875769.exe, PE32 26->116 dropped 192 Antivirus detection for dropped file 26->192 194 Multi AV Scanner detection for dropped file 26->194 196 Machine Learning detection for dropped file 26->196 32 z1345504.exe 26->32         started        118 C:\Users\user\AppData\Local\...\y6968494.exe, PE32 30->118 dropped 120 C:\Users\user\AppData\Local\...\n4851373.exe, PE32 30->120 dropped 36 y6968494.exe 1 4 30->36         started        38 n4851373.exe 4 30->38         started        signatures10 process11 dnsIp12 88 C:\Users\user\AppData\Local\...\z5683712.exe, PE32 32->88 dropped 90 C:\Users\user\AppData\Local\...\u1151966.exe, PE32 32->90 dropped 136 Antivirus detection for dropped file 32->136 138 Multi AV Scanner detection for dropped file 32->138 140 Machine Learning detection for dropped file 32->140 41 z5683712.exe 32->41         started        92 C:\Users\user\AppData\Local\...\m4677147.exe, PE32 36->92 dropped 94 C:\Users\user\AppData\Local\...\l4106397.exe, PE32 36->94 dropped 45 l4106397.exe 3 36->45         started        47 m4677147.exe 13 36->47         started        130 77.91.124.82, 19071, 49726, 49785 ECOTEL-ASRU Russian Federation 38->130 142 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 38->142 144 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 38->144 file13 signatures14 process15 dnsIp16 108 C:\Users\user\AppData\Local\...\z1111562.exe, PE32 41->108 dropped 110 C:\Users\user\AppData\Local\...\t3082181.exe, PE32 41->110 dropped 184 Antivirus detection for dropped file 41->184 186 Multi AV Scanner detection for dropped file 41->186 188 Machine Learning detection for dropped file 41->188 50 z1111562.exe 41->50         started        54 t3082181.exe 41->54         started        112 C:\Users\user\AppData\Local\...\explonde.exe, PE32 45->112 dropped 190 Contains functionality to inject code into remote processes 45->190 56 explonde.exe 17 45->56         started        134 5.42.92.211, 49722, 80 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 47->134 file17 signatures18 process19 dnsIp20 96 C:\Users\user\AppData\Local\...\z6207367.exe, PE32 50->96 dropped 98 C:\Users\user\AppData\Local\...\s1646839.exe, PE32 50->98 dropped 154 Antivirus detection for dropped file 50->154 156 Multi AV Scanner detection for dropped file 50->156 158 Machine Learning detection for dropped file 50->158 59 z6207367.exe 50->59         started        63 s1646839.exe 50->63         started        160 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 54->160 162 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 54->162 164 Tries to harvest and steal browser information (history, passwords, etc) 54->164 132 77.91.68.52, 49723, 49724, 49725 FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU Russian Federation 56->132 100 C:\Users\user\AppData\Roaming\...\clip64.dll, PE32 56->100 dropped 102 C:\Users\user\AppData\Local\...\clip64[1].dll, PE32 56->102 dropped 166 Creates an undocumented autostart registry key 56->166 168 Uses schtasks.exe or at.exe to add and modify task schedules 56->168 65 cmd.exe 1 56->65         started        67 schtasks.exe 1 56->67         started        69 rundll32.exe 56->69         started        file21 signatures22 process23 file24 122 C:\Users\user\AppData\Local\...\r4285427.exe, PE32+ 59->122 dropped 124 C:\Users\user\AppData\Local\...\q6551563.exe, PE32 59->124 dropped 198 Antivirus detection for dropped file 59->198 200 Multi AV Scanner detection for dropped file 59->200 202 Machine Learning detection for dropped file 59->202 71 q6551563.exe 59->71         started        74 r4285427.exe 59->74         started        76 conhost.exe 65->76         started        78 cmd.exe 1 65->78         started        80 cmd.exe 1 65->80         started        84 4 other processes 65->84 82 conhost.exe 67->82         started        signatures25 process26 signatures27 176 Antivirus detection for dropped file 71->176 178 Multi AV Scanner detection for dropped file 71->178 180 Machine Learning detection for dropped file 71->180 182 2 other signatures 71->182 86 conhost.exe 74->86         started        process28
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f81da8996e34359d2d78929ffc5cf829eb102f92676960936f42bcfcf6085a8c/
Threat name:
Win32.Trojan.Amadey
Create hunting rule
Status:
Malicious
First seen:
2023-09-06 18:33:07 UTC
File Type:
PE (Exe)
Extracted files:
347
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ao2rglogq2z2llyskp7yxhyfhvral4sm5uwbe3pik6pz5qilkga._file
Verdict:
malicious
Similar samples:
0391a506cb7415cea3ce31589bd12a5c724eb16e8b4f923aa9fefc7eb48b1ccb
Amadey
134d00e4db5cd67b9541db642d43e890de20175bc4b55445c3007e5a02b5a238
Amadey
26918e9ba064d1103201e95f3365ce9fc0106b12f5faea3c5f0bbfbc226d2850
Amadey
49b2c4652c7c95e8786bc270aee1d8384c75a7164f0f3df0baae7fdab571a347
Amadey
4b99a608a3e190a4198c2ef97805fe9af771df6c2e217e06b8e3f49c6daa2ef7
Amadey
545b0788b07c9c9820390f0057e9830cf18a4b4ca2140b11c459509838a927bd
Amadey
83890d88f756c2fa05e683e88a06062ce4dbbeefaf74c0241badb294c14b0aeb
Amadey
8dd2405699cf0e2054b82da7c5c986ddbcbfd175ac18ba72a3ddab5a24b21046
Amadey
f289dc187746f60222a915c4d520ef035da75b6a6fd7e569ed111aab07bd8856
Amadey
f793e51ce11573edeba45c9ae5c3d7257b6c40a271bc9c4dd15173af08719020
Amadey
+ 1'853 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:redline botnet:mrak infostealer persistence trojan
Link:
https://tria.ge/reports/230906-2qhp5sce71/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Amadey
RedLine
Malware Config
C2 Extraction:
77.91.68.52/mac/index.php
77.91.124.82:19071
Unpacked files
SH256 hash:
81aa2e80fbceb1bafc1c88cba1286221edd837bede5f66a08fdf9f93b65b5931
MD5 hash:
4890b43792b80b0b585a198e76355db1
SHA1 hash:
fc2e70a931e6c4d4a9ab702bcca5dbe70e086130
Detections:
Amadey
Create hunting rule
Link:
https://www.unpac.me/results/0de4fcb4-521a-4b95-b4b9-07ae9d3343c3/
Parent samples :
b80293318467bc0d3c8e676ef544ef9e973eb14150740338c2ddc0f5671494ee
49b2c4652c7c95e8786bc270aee1d8384c75a7164f0f3df0baae7fdab571a347
134d00e4db5cd67b9541db642d43e890de20175bc4b55445c3007e5a02b5a238
83890d88f756c2fa05e683e88a06062ce4dbbeefaf74c0241badb294c14b0aeb
7618db26dc150c1237d7cdde1c587e2f437d1e0e7db8e1fe7b34038a1837922a
f289dc187746f60222a915c4d520ef035da75b6a6fd7e569ed111aab07bd8856
8ec4090935de015f46e08416f184677b909b2a7cf1d20dc5e5093448e52ebb63
0272c4a874a3cd4dca12efcd877a694be1ef7fb94c98d17b4eeb7950322df4b8
066f392f47768baba4e64a750d8c99ddfe8c478d60ebe05940c51e60413d55f5
c256b9e29a8afbf29ab034dc3a2f9d5471ed96c11a571a1488a4b4b239358030
7c70cd2c5fc2c2b8a6fe10f9146baec1c1ab59d1e68af2200fb8e288118117f1
ae4adf02ab9a9c7a620e862b15a58f52e1fccfed1c037c7c9391ac58772d879f
8a03c0f12e37253db733b4fab4b408da428e76befcb89e07a38be181c635badb
3f25901317aebc10c1e629d57a681af123d22c108041a7b6e32b9c73fb68ab6b
2e3f68e6d0f5ec5ff7b76b407afd11ea2c8953f3d18b0ca936ddf60485bd64e8
66af14d6592e8faff5fd3272e970e5504db7a3cab76f9ffb3166b8ec2d8f595d
629dcbb4561608db7414a066608d04fa31bd03f9cb851541a425241137089f69
fdac697e3ebc8b14068aaaa8fa611eb8bb9eb10b245ff3f964fbc4aec14e64c5
de2054cdf6e9cb7d4b919f75d6de21f5495485cb5895818290cf76a1c891e40c
f8622648a071fa266b754a80f29c31bf60e3fb3b08f5b34ff20fc701ccbe162b
8cf67c6e6e65d32b37c85ea49b31ce86586fd96db10ec6144f22196e63ad3d5b
0d761392bbee9971fa37c751abbe23eb4c321130cc9997598993808da09959cb
5338760998fa35f5921c77eed3ea5baebd1a76eef432cf287a5cf2d3bf474a5a
154c1776876efc50c5f967d8522e52b3166acb41066c1545a23d675bfaf8ad61
535f96886d7e7191f1b678a522b0aab54b8316c69048466e1358406420cbc962
dae5bfaf48654693ff2b04632bf8faf9b55245ad386d0a8a7c2bedaec3455b0d
698e2b8858d93ebe9f612edd87559cfabe61b6fbdc7fe5c56ac8ffeb83eb01ef
2190623b860d6783e4c6758c057ceecb9023c3b89b824cacc74e6a9c84ed99c1
a93b9595d044bb82b6e57302b12a6b6b0e2e73709793e981ac013cc2dee3f478
d303e5a89bf8a298fb251b8787b820a23a1de49f9deb8e3912c45476e82d1c12
0bce887db3f2804a956bd717f24d00949e3e50bf56f599854b17e2744c4e77cf
e2e2212e0e0e8c7ef874f77ffb96b94ecaf83aef20f1fbb3570e04fdd893264a
30ef7d299dcc5ad838d0b2a648e9976e601f42820c6581871d6a0a8df7dc993c
f81da8996e34359d2d78929ffc5cf829eb102f92676960936f42bcfcf6085a8c
9363f5619c83680d343ba9202a48267bb59bfd7664e9c5572d7e47ff6b345b46
8b95af174d1873982c36cf8456debf0816e920555938603dfd4bcdc733e786c1
917df51788e12073af3eaf072b658f4d12cd2187966a110e37521681dfbf6872
db57f0ca9ed05c3ea9168edec891cf155bd6e054a004520cb27a2caf25804665
SH256 hash:
23ab8940b2d77bac7caa36a34b763a34aedf6db448b0be3d1b6ae6b4e0f0e6fb
MD5 hash:
bc23924907da63cc009457d65303d256
SHA1 hash:
8a0db3b3e77be73192d1ca7fe20e2e18939929da
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/0de4fcb4-521a-4b95-b4b9-07ae9d3343c3/
Parent samples :
b80293318467bc0d3c8e676ef544ef9e973eb14150740338c2ddc0f5671494ee
49b2c4652c7c95e8786bc270aee1d8384c75a7164f0f3df0baae7fdab571a347
134d00e4db5cd67b9541db642d43e890de20175bc4b55445c3007e5a02b5a238
83890d88f756c2fa05e683e88a06062ce4dbbeefaf74c0241badb294c14b0aeb
7618db26dc150c1237d7cdde1c587e2f437d1e0e7db8e1fe7b34038a1837922a
f289dc187746f60222a915c4d520ef035da75b6a6fd7e569ed111aab07bd8856
8ec4090935de015f46e08416f184677b909b2a7cf1d20dc5e5093448e52ebb63
0272c4a874a3cd4dca12efcd877a694be1ef7fb94c98d17b4eeb7950322df4b8
066f392f47768baba4e64a750d8c99ddfe8c478d60ebe05940c51e60413d55f5
c256b9e29a8afbf29ab034dc3a2f9d5471ed96c11a571a1488a4b4b239358030
7c70cd2c5fc2c2b8a6fe10f9146baec1c1ab59d1e68af2200fb8e288118117f1
ae4adf02ab9a9c7a620e862b15a58f52e1fccfed1c037c7c9391ac58772d879f
8a03c0f12e37253db733b4fab4b408da428e76befcb89e07a38be181c635badb
3f25901317aebc10c1e629d57a681af123d22c108041a7b6e32b9c73fb68ab6b
2e3f68e6d0f5ec5ff7b76b407afd11ea2c8953f3d18b0ca936ddf60485bd64e8
66af14d6592e8faff5fd3272e970e5504db7a3cab76f9ffb3166b8ec2d8f595d
629dcbb4561608db7414a066608d04fa31bd03f9cb851541a425241137089f69
fdac697e3ebc8b14068aaaa8fa611eb8bb9eb10b245ff3f964fbc4aec14e64c5
de2054cdf6e9cb7d4b919f75d6de21f5495485cb5895818290cf76a1c891e40c
f8622648a071fa266b754a80f29c31bf60e3fb3b08f5b34ff20fc701ccbe162b
8cf67c6e6e65d32b37c85ea49b31ce86586fd96db10ec6144f22196e63ad3d5b
0d761392bbee9971fa37c751abbe23eb4c321130cc9997598993808da09959cb
5338760998fa35f5921c77eed3ea5baebd1a76eef432cf287a5cf2d3bf474a5a
154c1776876efc50c5f967d8522e52b3166acb41066c1545a23d675bfaf8ad61
535f96886d7e7191f1b678a522b0aab54b8316c69048466e1358406420cbc962
dae5bfaf48654693ff2b04632bf8faf9b55245ad386d0a8a7c2bedaec3455b0d
698e2b8858d93ebe9f612edd87559cfabe61b6fbdc7fe5c56ac8ffeb83eb01ef
2190623b860d6783e4c6758c057ceecb9023c3b89b824cacc74e6a9c84ed99c1
a93b9595d044bb82b6e57302b12a6b6b0e2e73709793e981ac013cc2dee3f478
d303e5a89bf8a298fb251b8787b820a23a1de49f9deb8e3912c45476e82d1c12
0bce887db3f2804a956bd717f24d00949e3e50bf56f599854b17e2744c4e77cf
e2e2212e0e0e8c7ef874f77ffb96b94ecaf83aef20f1fbb3570e04fdd893264a
30ef7d299dcc5ad838d0b2a648e9976e601f42820c6581871d6a0a8df7dc993c
f81da8996e34359d2d78929ffc5cf829eb102f92676960936f42bcfcf6085a8c
9363f5619c83680d343ba9202a48267bb59bfd7664e9c5572d7e47ff6b345b46
8b95af174d1873982c36cf8456debf0816e920555938603dfd4bcdc733e786c1
917df51788e12073af3eaf072b658f4d12cd2187966a110e37521681dfbf6872
db57f0ca9ed05c3ea9168edec891cf155bd6e054a004520cb27a2caf25804665
SH256 hash:
729434e7582bea15ec03b2b2ff3b5f50effb2e1304d4f9648454a3b8ad1dc97c
MD5 hash:
cd91e02431fc5f29ff209feceb5fffec
SHA1 hash:
14f2a956476f814817045ca597a1b354ce924ce3
Link:
https://www.unpac.me/results/0de4fcb4-521a-4b95-b4b9-07ae9d3343c3/
SH256 hash:
476a578cafc423231f5a5c164c42ae35213b020c69327acf14817429189dac0a
MD5 hash:
ff1b2e0de07ca29b5be1a1547f32c41e
SHA1 hash:
ef1ee7986021c025f089c8c14940a29fa28e4374
Link:
https://www.unpac.me/results/0de4fcb4-521a-4b95-b4b9-07ae9d3343c3/
SH256 hash:
f81da8996e34359d2d78929ffc5cf829eb102f92676960936f42bcfcf6085a8c
MD5 hash:
72d8d55daaaea363d2202ce5fb503b1e
SHA1 hash:
e3d72a3dd3e82fc1aeee07a4954485c6a71610e1
Link:
https://www.unpac.me/results/0de4fcb4-521a-4b95-b4b9-07ae9d3343c3/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f81da8996e34/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f81da8996e34359d2d78929ffc5cf829eb102f92676960936f42bcfcf6085a8c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_Redline_Stealer
Create hunting rule
Author:Varp0s

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Amadey

Executable exe f81da8996e34359d2d78929ffc5cf829eb102f92676960936f42bcfcf6085a8c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2709614/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/446768/

Comments