MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fb8188ffb0cf446d8a43dafc15adc94f590f3bbef120b92e950d0acc230de7bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 13
| SHA256 hash: | fb8188ffb0cf446d8a43dafc15adc94f590f3bbef120b92e950d0acc230de7bd |
|---|---|
| SHA3-384 hash: | 53b08c4b2e0221dca506cb8b05afca6b5fdb97508dcafe12bf23f88fdfa4310581e58cbff4d51fd6c2a6ed626e985172 |
| SHA1 hash: | 8d8e7342d651e20eaeb6dbfd2ae8dee55e5263b9 |
| MD5 hash: | eabb111c74b1858f68abda80f3991adc |
| humanhash: | hawaii-speaker-muppet-colorado |
| File name: | file |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 494'080 bytes |
| First seen: | 2022-12-09 15:00:46 UTC |
| Last seen: | 2022-12-09 15:29:29 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | dd021619be333394dbb32a14f86d077c (8 x Smoke Loader, 5 x Amadey, 3 x RedLineStealer) |
| ssdeep | 12288:b3Ih8Ck4RbY7awmeQdz8g0IK9W9Dg6aw:bJC7caw1m0x9Ek69 |
| Threatray | 13'268 similar samples on MalwareBazaar |
| TLSH | T1CBB4E0113699C4F2C7620D370C25DBE1E93BB82BFB245937F7682B6F6E702B09562215 |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | c11edecea6ac8ccc (199 x Amadey, 139 x Smoke Loader, 22 x RedLineStealer) |
| Reporter |  andretavare5 |
| Tags: | exe RedLineStealer |
Intelligence
File Origin
# of uploads :
15
# of downloads :
185
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Connecting to a non-recommended domain
Sending a custom TCP request
DNS request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Amadey
Status:
Malicious
First seen:
2022-12-09 15:01:09 UTC
File Type:
PE (Exe)
Extracted files:
57
AV detection:
18 of 26 (69.23%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 13'258 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline botnet:@2023@ discovery infostealer spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
193.106.191.138:32796
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
03422f1864749eb9e9a4112874f8df8ca1d097dd8530606e059bbcea4e1ac94d
MD5 hash:
26411c584ce89fd532e0d93e7376582a
SHA1 hash:
feadf8f652baf05f673fd1625d9e1f77805de458
SH256 hash:
c137a1ac2016f59f165597ed49f0fec55ecaa2072faea10ef93d43e950aac092
MD5 hash:
40d68df7d158f3cb6358d19b5d480fb2
SHA1 hash:
fcabab5d80446ab8abd87ce67bb76ac65e9904af
SH256 hash:
da1bd19ff4688ae8271f2d6bb11e5569500d74b2e31ef7ff7bd7ddead5e212f7
MD5 hash:
01461f81a5113e9997c63174e267bb1b
SHA1 hash:
f42fef16c5c7a283a123c3df240a9c0cf8cc06be
SH256 hash:
23a57c22b5e23e7bc77b31a9a9b1a22812d6e381e3710c1da7ddeef9bf24f523
MD5 hash:
02b0e1c2caa207a3efa841f7b68514a8
SHA1 hash:
a97d9bfbec0cd9fc5110c6627b3e9ca7c93f6b7e
SH256 hash:
ad0b319f7717661c83d2b049a4205cd1fe0d4ac35cbc99e37b81be8a274dca13
MD5 hash:
4ab0af7ede013976b5c51f5572e1d1b7
SHA1 hash:
2362756cca3a01a9f696de0cdc1d400fe90bdec6
SH256 hash:
f3c9baa79aab4cf6f379c1e54b0dcda5a1205d4eebae39e9d76538ab047d8c33
MD5 hash:
472535b84351188b317b24f5814c5758
SHA1 hash:
0e7e4414de8e3764ac2fcd2980c42c77326862f6
SH256 hash:
fb8188ffb0cf446d8a43dafc15adc94f590f3bbef120b92e950d0acc230de7bd
MD5 hash:
eabb111c74b1858f68abda80f3991adc
SHA1 hash:
8d8e7342d651e20eaeb6dbfd2ae8dee55e5263b9
Malware family:
RedNet
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | MALWARE_Win_RedLine |
|---|---|
| Author: | ditekSHen |
| Description: | Detects RedLine infostealer |
| Rule name: | pdb_YARAify |
|---|---|
| Author: | @wowabiy314 |
| Description: | PDB |
| Rule name: | Windows_Trojan_Smokeloader_3687686f |
|---|---|
| Author: | Elastic Security |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Dropped by
PrivateLoader
Delivery method
Distributed via drive-by
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.