MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb22147ec9bdac2010950c88bb5253729eab2fccaea5761c290aac89aefc3893. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fb22147ec9bdac2010950c88bb5253729eab2fccaea5761c290aac89aefc3893
SHA3-384 hash:	f992a93778db23bd6f0c8ec67f8b5844a218b478007ee1d4fdad603ce2ced94a503061481edce38954b66e85dfa1d622
SHA1 hash:	4afff6cd4991a6f2021446faea7ebb99430c583a
MD5 hash:	86d1dc94a82221d8b0802062521d3125
humanhash:	football-sixteen-quiet-zulu
File name:	fb22147ec9bdac2010950c88bb5253729eab2fccaea5761c290aac89aefc3893
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	1'172'480 bytes
First seen:	2023-05-14 18:39:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep	24576:ey49H07MNUT49cmA++bYJlZjYlqyr34eJTgpR0b3rLo2Iu:tcUKDHAfbRqysokpC73k
TLSH	T1AB452347A7DE5473E8B227B144FB02830E367C514D70876A239AA94E5D73AD0E6313BB
TrID	70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 3.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):
dhash icon	f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter	JaffaCakes118
Tags:	RedLineStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

59

Origin country :

GB

Vendor Threat Intelligence

ANY.RUN redline

Malware family:

redline

Alert

Create hunting rule

ID:

1

File name:

fb22147ec9bdac2010950c88bb5253729eab2fccaea5761c290aac89aefc3893

Verdict:

Malicious activity

Analysis date:

2023-05-14 20:18:06 UTC

Tags:

rat redline amadey trojan loader

Link:

https://app.any.run/tasks/0fed6eda-032e-4c3e-a5f4-c7f19c799457

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox RedLine

Detection:

RedLine

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/389788/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28840.BadO.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Launching a service

Sending a custom TCP request

Creating a file

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a window

Blocking the Windows Defender launch

Disabling the operating system update service

Unauthorized injection to a recently created process

Sending a TCP request to an infection source

Stealing user critical data

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/84507/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

EvasionQueryPerformanceCounter

EvasionGetTickCount

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

advpack.dll anti-vm CAB confuserex installer packed packed rundll32.exe setupapi.dll shell32.dll

Link:

https://www.filescan.io/uploads/64612b3eed1a1a10659201e2/reports/e399c5c0-bfdc-44f2-a52a-bc1cb179d9d5/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/fb22147ec9bdac2010950c88bb5253729eab2fccaea5761c290aac89aefc3893

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Intezer RedLine stealer

Malware family:

RedLine stealer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3a698527-81ff-4496-bd72-acb859c7fd83

Joe Sandbox RedLine

Result

Threat name:

RedLine

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1232980

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb22147ec9bdac2010950c88bb5253729eab2fccaea5761c290aac89aefc3893/

ReversingLabs TitaniumCloud Win32.Trojan.Privateloader

Threat name:

Win32.Trojan.Privateloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-13 15:20:27 UTC

File Type:

PE (Exe)

Extracted files:

115

AV detection:

19 of 24 (79.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7mrbi7wjxwwcaeevbselwustokpkwl6mv2sxmhbjbkwitlx4hcjq._file

Hatching Triage redline

Result

Malware family:

redline

Alert

Create hunting rule

Score:

  10/10

Tags:

family:redline botnet:miran botnet:raven discovery evasion infostealer persistence spyware stealer trojan

Link:

https://tria.ge/reports/230514-xbj77sfc9x/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Modifies Windows Defender Real-time Protection settings

RedLine

Malware Config

C2 Extraction:

185.161.248.75:4132

UnpacMe redline

Unpacked files

SH256 hash:

f09c3920ba074df136ee1f196c204113f76213443fcc70b8074bd6ea5d92bd71

MD5 hash:

ca1b5c6178e9faa5d067f2fbb1461ec7

SHA1 hash:

e0869a1e51047796e25495f6811b0db21d2941fe

Link:

https://www.unpac.me/results/d4507f9d-b275-46fb-9269-b26cc6d81f09/

SH256 hash:

c2d5c4e48614ee87eaa5d9c1912b4dd7c205b1537c34a7efeb7a9c58a2851e0e

MD5 hash:

00276eb7a675e1b5f0a976bd6e0c19d1

SHA1 hash:

07281cd1606a6e316f05c18a57818cc9e5e7b739

Link:

https://www.unpac.me/results/d4507f9d-b275-46fb-9269-b26cc6d81f09/

SH256 hash:

944cf47fa2935e6902ff0f2ebd1d1a80637c32453a005c5a49932c82e2f644e9

MD5 hash:

a2a5dd0a0c60f667c37131a2c1969679

SHA1 hash:

9a239d7022202059eaf2c8ec4cef8af07bfb6841

Detections:

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/d4507f9d-b275-46fb-9269-b26cc6d81f09/

Parent samples :

17c3b4a77181d9fec2839f539f37f5828774edc7ce334f8b14ed4a400624bd62
2a8b129852665480672fdc9383c03bb4359b33c3c3b058aa9f503410ab8c8b8a
ba401da0d62d69b098447b5a07772436f599269929429a61f9a85f6857a66ab0
bcdc70c860f3772af96cbf35f4f33e04540489c86fbfbcf9c1df8fb2b0f10daa
bfa12b1c6e5f3c58b25ab7463050c395c92123ed5a282e8b37f2d600a8ad4adb
c30b4fb833c6e6c5cc0307e82746de060e08980c10d9113fbcf16324ed43841f
d1d0f16a62ef41e98a1dc2c65953c623a01e5e12ee7a6bdbed8a1ad25e188c64
d7d08809eeaaa72b382638d6facf28eac7c31e9fa7b385285784929c8fbb8aa6
d8fc27a3a73f3add555c9e6e63fa933e72038548af1e341323c3d7569e48636f
dcfa688395b63f54f26bb2d6df4bbdac7fbacd7a29f6abee3c03233119846a2e
dfa50aec7acb8553aedf43e2ab3dcc1b226895326d631de2acd1714b89d53794
e2b2664bc1ae0bc34326e2a4bd6b4699afe2401c8ef72858e1dc9c21972cdbf0
e4e4cb6303b8e4b7f52439a5fd470d1d362850b4cfe0491af1152c89f70bf0c6
ea7ab7d36e5120a8a3f25e0a9a4b87c28f535c7ca3d1f34f05bc188d8a6c44df
eeed49d3b75a71792b11ed9e714e0d9dd0730336811ca26f8ac9c742d548a15e
f00ef46391f8c6228eac11439ab8020d8111bcde4944978eddc89952663125bc
f3d6748b88f45598e4db85b3d2bd9c98532da20152703d50f74619354ab997ab
f6e43abf63a28725b10b89c1351e85ae417981d372b450fd81b05ec655c0a252
fb22147ec9bdac2010950c88bb5253729eab2fccaea5761c290aac89aefc3893
ffcdbeb2750ad3f9e667de2c513c025a2e5920af2677bcebc9d09d7f694e7731

SH256 hash:

4dbf7104a68cf3712824e924a0a69fd24b4a3b6704a509e3c17b18b26e3eb2cc

MD5 hash:

1add826fe31fbb76b4659d74f81e343b

SHA1 hash:

82a5d4f1f6d7119773b9ec03e2722c79edc56668

Link:

https://www.unpac.me/results/d4507f9d-b275-46fb-9269-b26cc6d81f09/

SH256 hash:

050d18ea98747dc199b7fae592cad46e43d83212e46ef6fb8459f1dc376dc020

MD5 hash:

a3df53244353247e8089e0abe89cf376

SHA1 hash:

3fed5a12ce8f1b1cfcc883917f67d6a2a052ab4e

Link:

https://www.unpac.me/results/d4507f9d-b275-46fb-9269-b26cc6d81f09/

SH256 hash:

b47bdb2222abce1f1e1fc696a9ff4f3d91955d3c79fe9f92111465f705669c83

MD5 hash:

16cb815ecc98f1ed74d585fcaf13d332

SHA1 hash:

54aef4fd0ab17335744194008293a49a403e9d6f

Link:

https://www.unpac.me/results/d4507f9d-b275-46fb-9269-b26cc6d81f09/

SH256 hash:

fb22147ec9bdac2010950c88bb5253729eab2fccaea5761c290aac89aefc3893

MD5 hash:

86d1dc94a82221d8b0802062521d3125

SHA1 hash:

4afff6cd4991a6f2021446faea7ebb99430c583a

Link:

https://www.unpac.me/results/d4507f9d-b275-46fb-9269-b26cc6d81f09/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Redline

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fb22147ec9bdac2010950c88bb5253729eab2fccaea5761c290aac89aefc3893

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/389788/