MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05f2a5530c978ebaec2034ef6d4006b6c4a7d8fc38cb9050fb0aed955a391d79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


StealthWorker


Vendor detections: 9


Intelligence 9 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05f2a5530c978ebaec2034ef6d4006b6c4a7d8fc38cb9050fb0aed955a391d79
SHA3-384 hash: 8c64a07bdd47269430cddf3ac33b2143ef43ee4748e8cafb6002992913820e872e9c178b21b4eba159b554388a66c6dd
SHA1 hash: b45a17986dc41e7df31f123721e3afc66dfd48a9
MD5 hash: 8a481e503ea29b01dc8869801be68f75
humanhash: pennsylvania-mike-lactose-missouri
File name:8a481e503ea29b01dc8869801be68f75.exe
Download: download sample
Signature StealthWorker
Create hunting rule
File size:282'624 bytes
First seen:2021-08-21 11:20:54 UTC
Last seen:2021-08-21 12:03:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ad1c5bf15a899fcfef408e3485448e67 (11 x RedLineStealer, 2 x StealthWorker, 2 x Smoke Loader)
ssdeep 6144:J0ifQKNKxQyH5L7XW+B0fol8UYBI3i26wzX:lfQKNSQyt7vB0foq4i26QX
Threatray 119 similar samples on MalwareBazaar
TLSH T156549D20B7A0C139E4F211F4597DE3AC69287DB06B2450CB63D636EEA6376E4DD30687
dhash icon ead8ac9cc6e68ee0 (118 x RaccoonStealer, 102 x RedLineStealer, 46 x Smoke Loader)
Reporter abuse_ch
Tags:exe StealthWorker


Avatar
abuse_ch
StealthWorker C2:
194.26.29.184:8888

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
194.26.29.184:8888 https://threatfox.abuse.ch/ioc/192543/

Intelligence

File Origin
# of uploads :
2
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8a481e503ea29b01dc8869801be68f75.exe
Verdict:
No threats detected
Analysis date:
2021-08-21 11:25:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c4f26506-0d24-424b-bee5-62e32b8d1483

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/181079/
Detection(s):
SecuriteInfo.com.Trojan.Siggen14.62415.20973.14718.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending a UDP request
Connection attempt
Sending an HTTP POST request
Creating a process from a recently created file
Deleting of the original file
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/678a55fe-b7f2-4ea9-b3d3-0008c7411d43
Result
Threat name:
Amadey RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/836776
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Amadey bot
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 469207 Sample: 1yjdhFZCbT.exe Startdate: 21/08/2021 Architecture: WINDOWS Score: 100 61 trustmanager.ug 2->61 79 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->79 81 Multi AV Scanner detection for domain / URL 2->81 83 Found malware configuration 2->83 85 9 other signatures 2->85 11 1yjdhFZCbT.exe 2->11         started        14 crhiebv 2->14         started        16 rnyuf.exe 2->16         started        18 rnyuf.exe 2->18         started        signatures3 process4 signatures5 121 Detected unpacking (changes PE section rights) 11->121 123 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 11->123 125 Maps a DLL or memory area into another process 11->125 127 Creates a thread in another existing process (thread injection) 11->127 20 explorer.exe 5 11->20 injected 129 Multi AV Scanner detection for dropped file 14->129 131 Machine Learning detection for dropped file 14->131 133 Checks if the current machine is a virtual machine (disk enumeration) 14->133 process6 dnsIp7 67 atvcampingtrips.com 31.167.180.141, 49717, 49719, 49720 MOBILY-ASEtihadEtisalatCompanyMobilySA Saudi Arabia 20->67 69 193.142.59.248, 80 HOSTSLICK-GERMANYNL Netherlands 20->69 71 4 other IPs or domains 20->71 53 C:\Users\user\AppData\Roaming\crhiebv, PE32 20->53 dropped 55 C:\Users\user\AppData\Local\Temp\A7B6.exe, PE32 20->55 dropped 57 C:\Users\user\...\crhiebv:Zone.Identifier, ASCII 20->57 dropped 95 System process connects to network (likely due to code injection or exploit) 20->95 97 Benign windows process drops PE files 20->97 99 Deletes itself after installation 20->99 101 Hides that the sample has been downloaded from the Internet (zone.identifier) 20->101 25 9A6B.exe 4 20->25         started        29 8BB4.exe 14 3 20->29         started        32 A7B6.exe 15 26 20->32         started        file8 signatures9 process10 dnsIp11 59 C:\Users\user\AppData\Local\...\rnyuf.exe, PE32 25->59 dropped 103 Detected unpacking (changes PE section rights) 25->103 34 rnyuf.exe 14 25->34         started        73 188.124.36.242, 25802, 49767 SELECTELRU Russian Federation 29->73 105 Query firmware table information (likely to detect VMs) 29->105 107 Tries to detect sandboxes and other dynamic analysis tools (window names) 29->107 109 Hides threads from debuggers 29->109 111 Tries to detect sandboxes / dynamic malware analysis system (registry check) 29->111 38 conhost.exe 29->38         started        75 193.38.55.57, 49736, 49743, 49744 SERVERIUS-ASNL Russian Federation 32->75 77 api.ip.sb 32->77 113 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 32->113 115 Machine Learning detection for dropped file 32->115 117 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 32->117 119 Tries to harvest and steal browser information (history, passwords, etc) 32->119 40 conhost.exe 32->40         started        file12 signatures13 process14 dnsIp15 63 185.215.113.206, 49759, 49760, 49761 WHOLESALECONNECTIONSNL Portugal 34->63 65 trustmanager.ug 34->65 87 Detected unpacking (changes PE section rights) 34->87 89 Machine Learning detection for dropped file 34->89 91 Contains functionality to inject code into remote processes 34->91 93 Uses schtasks.exe or at.exe to add and modify task schedules 34->93 42 cmd.exe 1 34->42         started        44 schtasks.exe 34->44         started        signatures16 process17 process18 46 reg.exe 42->46         started        49 conhost.exe 42->49         started        51 conhost.exe 44->51         started        signatures19 135 Creates an undocumented autostart registry key 46->135
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05f2a5530c978ebaec2034ef6d4006b6c4a7d8fc38cb9050fb0aed955a391d79/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-08-21 09:42:24 UTC
AV detection:
22 of 46 (47.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=axzkkuyms6hlv3bagtxw2qagw3ckpwh4hdfzauh3blwzkwrzdv4q._file
Verdict:
unknown
Similar samples:
3221c7c857b80fab3818cf1ea9435cef9626d84bd308d7a365e4e5089e5ef413
StealthWorker
41ce43aa875bf977ec9eb039e5853ade1af522dd0dff4f19282f6c8038ae2dff
StealthWorker
6615e3bc3da0f2036f99b3bbf5aeafd9cb02811f5958dd3259e5013d954d12db
StealthWorker
7efe89836b4c06959a1af18891ff07995f8870f566149e8c537c6f76e2a31a89
StealthWorker
940856f93e56ecd69b6833c94a78247b3f8d60348ac9b73928fd338113fbbc9e
StealthWorker
a9c80fcb24dc9e32be9b5cc6a268de0e8a234f55fb8ecd723739a401f51095b2
StealthWorker
b5f88e34db4bb65da8c21982590b67922fe32e62e7cfaae9fbe417a4262aa143
StealthWorker
c7839db336f11c965ab8e6fbad1a6c757711a24362cc20d63d4ce37aef9b83b1
StealthWorker
ea36e3c08da0229c5cd34f1a683182efcac46e8922ee08a1a003470b94a4f476
StealthWorker
+ 109 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader botnet:jopanewe backdoor discovery evasion infostealer spyware stealer suricata themida trojan
Link:
https://tria.ge/reports/210821-st1tlly672/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
RedLine
RedLine Payload
SmokeLoader
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Malware Config
C2 Extraction:
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
193.38.55.57:7575
95.217.114.110:20535
Unpacked files
SH256 hash:
18cd8e90fcd46329480f24d43baa489683b3ee2fcd274bf1714947ef307a6ab2
MD5 hash:
f2fecf6872ad4c61a3a506159fddd4fc
SHA1 hash:
28e039eb96dcf58841992280c66433a2bbab8e84
Link:
https://www.unpac.me/results/473a08cd-bb7f-4cfa-bb37-4b5c7472ffa4/
SH256 hash:
05f2a5530c978ebaec2034ef6d4006b6c4a7d8fc38cb9050fb0aed955a391d79
MD5 hash:
8a481e503ea29b01dc8869801be68f75
SHA1 hash:
b45a17986dc41e7df31f123721e3afc66dfd48a9
Link:
https://www.unpac.me/results/473a08cd-bb7f-4cfa-bb37-4b5c7472ffa4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/05f2a5530c97/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/05f2a5530c978ebaec2034ef6d4006b6c4a7d8fc38cb9050fb0aed955a391d79

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

StealthWorker

Executable exe 05f2a5530c978ebaec2034ef6d4006b6c4a7d8fc38cb9050fb0aed955a391d79

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1533747/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1545011/
Cape
Cape
https://www.capesandbox.com/analysis/181079/

Comments