MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb77c72161a3885499d305cc95dd95a28426a5cf549fdfcbfa2b95c632171e41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fb77c72161a3885499d305cc95dd95a28426a5cf549fdfcbfa2b95c632171e41
SHA3-384 hash:	2d37fa180660798324f35934104822537c5e2feade5d2d25117d05e939afc62fc635a8c7a57a1a5ec6fdbfb698aca5fe
SHA1 hash:	329ef089536a9212d5ffe5ae17154f6805164cc3
MD5 hash:	9616c300332d78ec75bbe03ec634a159
humanhash:	lactose-yankee-blossom-wisconsin
File name:	9616c300332d78ec75bbe03ec634a159.exe
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	337'408 bytes
First seen:	2023-07-02 19:20:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	130761c8058587162de9b63262a67cc0 (8 x RedLineStealer, 2 x Tofsee, 2 x Amadey)
ssdeep	6144:H5L8ErdBSMg2yNchUeaMjN3SxrrpXqjatwQuCELyZQaNRtLy:Z7rdBrg2bhNwpX9mzDMY
Threatray	1 similar samples on MalwareBazaar
TLSH	T1C174E10353E0BC95E81686725E2EC2E8765DF5F08F5867A63E1C9AAF08B11F2D277701
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	00081040490c44a0 (1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
194.26.135.162:2920

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

264

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox RedLine

Detection:

RedLine

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/405450/

ClamAV Detected

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Stealing user critical data

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/94931/overview

Behaviour

MalwareBazaar

MeasuringTime

CPUID_Instruction

SystemUptime

CheckCmdLine

EvasionQueryPerformanceCounter

EvasionGetTickCount

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

greyware packed xpack

Link:

https://www.filescan.io/uploads/64a1ce252299d2688264276e/reports/30e2a0a9-c00b-4a29-8c41-704e530b6ead/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/fb77c72161a3885499d305cc95dd95a28426a5cf549fdfcbfa2b95c632171e41

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious Packer

Malware family:

Malicious Packer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5d1c73f5-8a61-469f-abef-b33afb91ccf6

Joe Sandbox RedLine

Result

Threat name:

RedLine

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1265217

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb77c72161a3885499d305cc95dd95a28426a5cf549fdfcbfa2b95c632171e41/

ReversingLabs TitaniumCloud Win32.Trojan.SmokeLoader

Threat name:

Win32.Trojan.SmokeLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-02 19:21:09 UTC

File Type:

PE (Exe)

Extracted files:

28

AV detection:

19 of 24 (79.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7n34oilbuoefjgotaxgjlxmvukccnjopksp57s72fok4mmqxdzaq._file

Threatray malicious

Verdict:

malicious

Similar samples:

c72a8287f05afce5b508575b2a85bdf624b19b55b0e25d75861e6d7f335ed62b

RedLineStealer

Hatching Triage redline

Result

Malware family:

redline

Alert

Create hunting rule

Score:

  10/10

Tags:

family:redline discovery infostealer spyware stealer

Link:

https://tria.ge/reports/230702-x2nnbadc34/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

UnpacMe 10

Unpacked files

SH256 hash:

e40d869c584136f073b23a1e35a3632b51024704a8836465a1ef14a6893c8290

MD5 hash:

2181ff0453146090efdc301dd36fbf67

SHA1 hash:

ee2f028b8b1b4c2ba6f3dc732e72e918285ef635

Link:

https://www.unpac.me/results/93053508-3c6d-42e5-8357-a5acfd7db466/

SH256 hash:

8acee876375e9e139f2c4b805142acc00566e7d35b47d192395a8bd34e94636e

MD5 hash:

c0766de0a38b7d3489800a1e2214f9c2

SHA1 hash:

312b9a946022f0654b5d65c3ca80e688ec8f14ec

Link:

https://www.unpac.me/results/93053508-3c6d-42e5-8357-a5acfd7db466/

SH256 hash:

95bcf6d38f4836fa5ffa8ef3780d5a6589b00cb99fc834eea774334ddf6864b5

MD5 hash:

7aced252e230592bfe5835e2ea2429bd

SHA1 hash:

0e7b3d44f6ed9c3cbc5530e4a5e626a4824522d9

Link:

https://www.unpac.me/results/93053508-3c6d-42e5-8357-a5acfd7db466/

SH256 hash:

e40d869c584136f073b23a1e35a3632b51024704a8836465a1ef14a6893c8290

MD5 hash:

2181ff0453146090efdc301dd36fbf67

SHA1 hash:

ee2f028b8b1b4c2ba6f3dc732e72e918285ef635

Link:

https://www.unpac.me/results/93053508-3c6d-42e5-8357-a5acfd7db466/

SH256 hash:

8acee876375e9e139f2c4b805142acc00566e7d35b47d192395a8bd34e94636e

MD5 hash:

c0766de0a38b7d3489800a1e2214f9c2

SHA1 hash:

312b9a946022f0654b5d65c3ca80e688ec8f14ec

Link:

https://www.unpac.me/results/93053508-3c6d-42e5-8357-a5acfd7db466/

SH256 hash:

95bcf6d38f4836fa5ffa8ef3780d5a6589b00cb99fc834eea774334ddf6864b5

MD5 hash:

7aced252e230592bfe5835e2ea2429bd

SHA1 hash:

0e7b3d44f6ed9c3cbc5530e4a5e626a4824522d9

Link:

https://www.unpac.me/results/93053508-3c6d-42e5-8357-a5acfd7db466/

SH256 hash:

e40d869c584136f073b23a1e35a3632b51024704a8836465a1ef14a6893c8290

MD5 hash:

2181ff0453146090efdc301dd36fbf67

SHA1 hash:

ee2f028b8b1b4c2ba6f3dc732e72e918285ef635

Link:

https://www.unpac.me/results/93053508-3c6d-42e5-8357-a5acfd7db466/

SH256 hash:

8acee876375e9e139f2c4b805142acc00566e7d35b47d192395a8bd34e94636e

MD5 hash:

c0766de0a38b7d3489800a1e2214f9c2

SHA1 hash:

312b9a946022f0654b5d65c3ca80e688ec8f14ec

Link:

https://www.unpac.me/results/93053508-3c6d-42e5-8357-a5acfd7db466/

SH256 hash:

95bcf6d38f4836fa5ffa8ef3780d5a6589b00cb99fc834eea774334ddf6864b5

MD5 hash:

7aced252e230592bfe5835e2ea2429bd

SHA1 hash:

0e7b3d44f6ed9c3cbc5530e4a5e626a4824522d9

Link:

https://www.unpac.me/results/93053508-3c6d-42e5-8357-a5acfd7db466/

SH256 hash:

fb77c72161a3885499d305cc95dd95a28426a5cf549fdfcbfa2b95c632171e41

MD5 hash:

9616c300332d78ec75bbe03ec634a159

SHA1 hash:

329ef089536a9212d5ffe5ae17154f6805164cc3

Link:

https://www.unpac.me/results/93053508-3c6d-42e5-8357-a5acfd7db466/

VMRay RedNet

Malware family:

RedNet

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fb77c72161a3/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fb77c72161a3885499d305cc95dd95a28426a5cf549fdfcbfa2b95c632171e41

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

exe fb77c72161a3885499d305cc95dd95a28426a5cf549fdfcbfa2b95c632171e41

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2670388/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/405450/