MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f969a04f7d3e1da3f6ff1c61c5de21357e12d01b2e7a48c26f3edd6b9040035e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f969a04f7d3e1da3f6ff1c61c5de21357e12d01b2e7a48c26f3edd6b9040035e
SHA3-384 hash:	84413c6b272b93e5247317f05686a9365aa9b60353495f86a7508425dc012274abca6caaca56184dd6eeecdab1a12fac
SHA1 hash:	ce5106ae7b616cda58eac1115757a6b47ce6175a
MD5 hash:	7e12996fe3be641fe52928d97d09df3c
humanhash:	mango-lithium-lima-jig
File name:	f969a04f7d3e1da3f6ff1c61c5de21357e12d01b2e7a48c26f3edd6b9040035e
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	897'024 bytes
First seen:	2023-05-14 18:39:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep	24576:ey/d2qysvtAhzHJAMdVUkhq1IPbKTz8TQoIWy1:ttVODJ3Gkh1PbKX8UoIW
TLSH	T1AF152313FADC4073D9B867712CF603831B35FCA2997893AF1B415E5A8873698697132B
TrID	70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 3.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):
dhash icon	f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter	JaffaCakes118
Tags:	RedLineStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

61

Origin country :

GB

Vendor Threat Intelligence

ANY.RUN redline

Malware family:

redline

Alert

Create hunting rule

ID:

1

File name:

f969a04f7d3e1da3f6ff1c61c5de21357e12d01b2e7a48c26f3edd6b9040035e

Verdict:

Malicious activity

Analysis date:

2023-05-14 20:12:47 UTC

Tags:

rat redline

Link:

https://app.any.run/tasks/ab538893-96e6-4bf7-b583-0cfb893e89da

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox RedLine

Detection:

RedLine

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/389783/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28840.BadO.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Creating a window

Unauthorized injection to a recently created process

Sending a TCP request to an infection source

Stealing user critical data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

91%

Tags:

advpack.dll anti-vm CAB confuserex installer packed packed rundll32.exe setupapi.dll shell32.dll

Link:

https://www.filescan.io/uploads/64612b2fed1a1a10659201d3/reports/c9e4f785-d50e-412a-a2bf-a22abb2d5e43/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/f969a04f7d3e1da3f6ff1c61c5de21357e12d01b2e7a48c26f3edd6b9040035e

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Intezer RedLine stealer

Malware family:

RedLine stealer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/00e8a631-2dd0-48f7-8278-8b4c785d0a71

Joe Sandbox Amadey, RedLine

Result

Threat name:

Amadey, RedLine

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1232993

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f969a04f7d3e1da3f6ff1c61c5de21357e12d01b2e7a48c26f3edd6b9040035e/

ReversingLabs TitaniumCloud Win32.Trojan.RedLineStealer

Threat name:

Win32.Trojan.RedLineStealer

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-14 18:41:52 UTC

File Type:

PE (Exe)

Extracted files:

116

AV detection:

19 of 24 (79.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7fu2at35hyo2h5x7drq4lxrbgv7bfua3fz5erqtph3owxecaanpa._file

Hatching Triage redline

Result

Malware family:

redline

Alert

Create hunting rule

Score:

  10/10

Tags:

family:redline botnet:dimas botnet:roza discovery evasion infostealer persistence spyware stealer trojan

Link:

https://tria.ge/reports/230514-xa46zsdb59/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Modifies Windows Defender Real-time Protection settings

RedLine

Malware Config

C2 Extraction:

185.161.248.75:4132

UnpacMe redline Amadey

Unpacked files

SH256 hash:

edb75fbc271e35fea91f27afb364e83415834c425e74459325da761cc46208f1

MD5 hash:

91fdf5a3b7d44678cbfdf03456bda886

SHA1 hash:

732c0c33ec2ef24e5c5a84669264620bbefacea8

Link:

https://www.unpac.me/results/cd7dd0ab-6f87-4f53-8f28-e782657e9b73/

SH256 hash:

aafe5c84fbc14d66059681fcde6d1fe31f5b5d7cbd61668c9dc205230bd1666d

MD5 hash:

6016a3c1d95f83441af06e24b7dea15b

SHA1 hash:

0d87ab90d96602c855f8c9bce4e3db4fe8752f21

Detections:

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/cd7dd0ab-6f87-4f53-8f28-e782657e9b73/

Parent samples :

ba79a15b3cbda4bd192dcb7b8f97db5cb93f1fbe765e441bf0a3048650f38d9a
c352e43ccbc8d777d8269a166687370c5ce3b2214eed91388f0b526986d5872a
cd49dffaaeb0970d0b772276ca7bd006dc454ec76fae4573460b967ba548d1a9
cef54ebfa08b43e20108ce4d348180f2aef2419347939b1b74a1e9e17f9de5b8
d9190ed86347f9cba9332dda6df8b0908fa99d65d3f716ee478d7cd4075098ba
f57886bdb2d832b23b39faa314053baaae8e9f12cfc1e4b32a61173dfeda1149
f969a04f7d3e1da3f6ff1c61c5de21357e12d01b2e7a48c26f3edd6b9040035e
fd933feb821f06d3f71361d1846ba2aeadda35ed1a68226acccbd37912db1380
ffb2caf2181442fa0c3f45eb342e31f7283eeaa8786f5ccffe0f8bfcfd166e8f

SH256 hash:

4a966a349412f02576acdda769a44963f35aa7d6adf7f6a9c19de39a24edcbf0

MD5 hash:

e4f7d727a85093cf7098b19d1d0a329c

SHA1 hash:

14bfe1e92a330e0fd3f7b3b79b6f81655bdbb014

Detections:

Amadey

Alert

Create hunting rule

Link:

https://www.unpac.me/results/cd7dd0ab-6f87-4f53-8f28-e782657e9b73/

Parent samples :

c3f2462022324939e04ab99725466a1a5e8ddb67128a9ac12d55bfeea5f2eb82
ba79a15b3cbda4bd192dcb7b8f97db5cb93f1fbe765e441bf0a3048650f38d9a
c352e43ccbc8d777d8269a166687370c5ce3b2214eed91388f0b526986d5872a
cc872766a374f59ab1426909dac2c5389aca234a7722647a80bf35cdddf10052
cef54ebfa08b43e20108ce4d348180f2aef2419347939b1b74a1e9e17f9de5b8
cf5049aaa76c4b36bf8698afc7835ce9feb208eae6437f86c84e3421911ccbec
d4d196df48d2d914dd297c964c0854fed7162eb5981fb99b3b23704e525a017e
d9190ed86347f9cba9332dda6df8b0908fa99d65d3f716ee478d7cd4075098ba
f57886bdb2d832b23b39faa314053baaae8e9f12cfc1e4b32a61173dfeda1149
f969a04f7d3e1da3f6ff1c61c5de21357e12d01b2e7a48c26f3edd6b9040035e
fd933feb821f06d3f71361d1846ba2aeadda35ed1a68226acccbd37912db1380

SH256 hash:

ae02731916c0577019002c44ff795015f93c89c90e966df79fc79c1f8b790c2d

MD5 hash:

f24cb7d92b2c4280c85e28b86a55cde3

SHA1 hash:

8a32a5eeee82bb6e93b86ead23cfcd4c90d59bb7

Link:

https://www.unpac.me/results/cd7dd0ab-6f87-4f53-8f28-e782657e9b73/

SH256 hash:

f969a04f7d3e1da3f6ff1c61c5de21357e12d01b2e7a48c26f3edd6b9040035e

MD5 hash:

7e12996fe3be641fe52928d97d09df3c

SHA1 hash:

ce5106ae7b616cda58eac1115757a6b47ce6175a

Link:

https://www.unpac.me/results/cd7dd0ab-6f87-4f53-8f28-e782657e9b73/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Redline

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f969a04f7d3e1da3f6ff1c61c5de21357e12d01b2e7a48c26f3edd6b9040035e

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/389783/