MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa146cfe8c5719a3b2f0cd36f32334956da9fe4eb83aabc0a2ad6e88dd33b430. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa146cfe8c5719a3b2f0cd36f32334956da9fe4eb83aabc0a2ad6e88dd33b430
SHA3-384 hash: 1b52decc90f047d08b4aa99348e14e961db8f471ad9e7bd9e4c10e82914ddc91dde15274cd57b8694ffdef41449227f4
SHA1 hash: 6bf5edda90baf13bfb9e3aa0ed506cc53118351f
MD5 hash: cc4d59c981a4263d1dca120b913c2ea0
humanhash: butter-six-nitrogen-march
File name:fa146cfe8c5719a3b2f0cd36f32334956da9fe4eb83aabc0a2ad6e88dd33b430.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:572'928 bytes
First seen:2024-01-02 18:56:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 12288:CMrZy90HltuNIECJkLPQpPvCjPagP+8leRLB/T:7y4GIEC2LP+ClG8leRd/T
TLSH T142C41217A6E89132D9B11BB00DFA07C30F367CE059689B5B738A6D1A0CF15D4A871B7B
TrID 41.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
22.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
11.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
7.5% (.EXE) Win64 Executable (generic) (10523/12/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter adm1n_usa32
Tags:exe RedLineStealer WEXTRACT

Intelligence

File Origin
# of uploads :
1
# of downloads :
287
Origin country :
RO RO
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.28840.BadO.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a window
Launching a process
Searching for the browser window
DNS request
Sending a custom TCP request
Reading critical registry keys
Launching a service
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
advpack anti-vm autoit CAB control explorer greyware installer keylogger lolbin lolbin packed rundll32 setupapi sfx shell32
Link:
https://www.filescan.io/uploads/65945c977d4bdb7f8b037dbf/reports/9eab150c-d8cb-472d-acb7-67890887b405/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/fa146cfe8c5719a3b2f0cd36f32334956da9fe4eb83aabc0a2ad6e88dd33b430
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2c31fa64-3e59-4072-8e0b-05d8f2712fd6
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1368933
Signature
Binary is likely a compiled AutoIt script file
Contains functionality to modify clipboard data
Found API chain indicative of sandbox detection
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1368933 Sample: rIuNOUgDsD.exe Startdate: 02/01/2024 Architecture: WINDOWS Score: 76 49 Multi AV Scanner detection for submitted file 2->49 51 Binary is likely a compiled AutoIt script file 2->51 53 Machine Learning detection for sample 2->53 8 rIuNOUgDsD.exe 1 4 2->8         started        12 rundll32.exe 2->12         started        process3 file4 33 C:\Users\user\AppData\Local\...\3aj65JD.exe, PE32 8->33 dropped 35 C:\Users\user\AppData\Local\...\1Ly29zj9.exe, PE32 8->35 dropped 55 Binary is likely a compiled AutoIt script file 8->55 14 1Ly29zj9.exe 12 8->14         started        17 3aj65JD.exe 12 8->17         started        signatures5 process6 signatures7 57 Multi AV Scanner detection for dropped file 14->57 59 Binary is likely a compiled AutoIt script file 14->59 61 Machine Learning detection for dropped file 14->61 19 chrome.exe 9 14->19         started        63 Found API chain indicative of sandbox detection 17->63 65 Contains functionality to modify clipboard data 17->65 22 chrome.exe 17->22         started        process8 dnsIp9 37 192.168.2.10 unknown unknown 19->37 39 192.168.2.17 unknown unknown 19->39 41 3 other IPs or domains 19->41 24 chrome.exe 19->24         started        27 chrome.exe 19->27         started        29 chrome.exe 6 19->29         started        31 chrome.exe 22->31         started        process10 dnsIp11 43 www.google.com 142.250.113.105, 443, 49745, 49809 GOOGLEUS United States 24->43 45 play.google.com 142.250.113.139, 443, 49788, 49789 GOOGLEUS United States 24->45 47 17 other IPs or domains 24->47
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fa146cfe8c5719a3b2f0cd36f32334956da9fe4eb83aabc0a2ad6e88dd33b430
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa146cfe8c5719a3b2f0cd36f32334956da9fe4eb83aabc0a2ad6e88dd33b430/
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2024-01-02 07:14:05 UTC
File Type:
PE (Exe)
Extracted files:
89
AV detection:
10 of 22 (45.45%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ikgz7umk4m2hmxqzu3pgizusvw2t7soxa5kxqfcvvxirxjtwqya._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/240102-23y8nabfbr/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
AutoIT Executable
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
104a17d2183f256674ee72101c14647e2c40910c08b4f66e94253ca409ef9c0b
MD5 hash:
30459f0b5bdb1dc4411816ce7d6d57d5
SHA1 hash:
86a15594f6f4abd72a8d4ea5c851172b6f006fce
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/d7b7b5ae-56a4-43a4-9604-e20f4b7a65a7/
Parent samples :
6f490f3430e51eabccc5ae73df35e0d2193da083f1760b562fa2ed7309a30490
fa146cfe8c5719a3b2f0cd36f32334956da9fe4eb83aabc0a2ad6e88dd33b430
SH256 hash:
fa146cfe8c5719a3b2f0cd36f32334956da9fe4eb83aabc0a2ad6e88dd33b430
MD5 hash:
cc4d59c981a4263d1dca120b913c2ea0
SHA1 hash:
6bf5edda90baf13bfb9e3aa0ed506cc53118351f
Link:
https://www.unpac.me/results/d7b7b5ae-56a4-43a4-9604-e20f4b7a65a7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fa146cfe8c5719a3b2f0cd36f32334956da9fe4eb83aabc0a2ad6e88dd33b430

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_Redline_Stealer
Create hunting rule
Author:Varp0s
Rule name:win_redline_wextract_hunting_oct_2023
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects wextract archives related to redline/amadey

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments