MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06c971a9f2e53a6ae48ec088ad16f1e1e7fc0bdf53c590f1b72955dac4e6bfa2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs 1 YARA File information Comments

SHA256 hash:	06c971a9f2e53a6ae48ec088ad16f1e1e7fc0bdf53c590f1b72955dac4e6bfa2
SHA3-384 hash:	a2578c8ca22188394a656a2b4014ea97a11b8d75379b96cc93b9d8db9e08f3bb52e0cd6afcad86788a81dbe7587973ae
SHA1 hash:	c2b2d159d2cdaba43092e748c2d92ba71d0472ef
MD5 hash:	4b92b290f488b69faeefa3775064db1b
humanhash:	friend-michigan-east-cup
File name:	4b92b290f488b69faeefa3775064db1b.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	311'808 bytes
First seen:	2022-05-22 10:00:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3a29ab1c3343b4f0710b44d27c177be4 (1 x RedLineStealer)
ssdeep	6144:G9E+sa0v6HOmL3UqhjZIMMG/s2AcImAQIHuVLJ1:GG+sEOgljZIMM4sEImAQKC
Threatray	4'686 similar samples on MalwareBazaar
TLSH	T15C647D107A50DC35E1B723F845B98269F7297EA1AB2440DB62D53AEE56346E0EC3132F
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	9824e7d0c4e7215c (11 x RedLineStealer, 5 x Smoke Loader, 2 x RaccoonStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
141.255.161.70:81

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
141.255.161.70:81	https://threatfox.abuse.ch/ioc/623370/

Intelligence

File Origin

# of uploads :

# of downloads :

314

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

4b92b290f488b69faeefa3775064db1b.exe

Verdict:

No threats detected

Analysis date:

2022-05-22 10:01:57 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0cea7363-347b-4308-a785-ff8f36cb5af2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/273397/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending a UDP request

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

azorult greyware packed smokeloader

Link:

https://www.filescan.io/uploads/628a09fc945ebb7eb17543b8/reports/f2f8c870-8d6b-45b1-a07c-988e100cbb22/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/15f95676-bb01-4022-8360-d0cfb3a9b2da

Result

Threat name:

RedLine, SmokeLoader

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/999289

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to infect the boot sector

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/06c971a9f2e53a6ae48ec088ad16f1e1e7fc0bdf53c590f1b72955dac4e6bfa2/

Threat name:

Win32.Backdoor.Mokes

Status:

Malicious

First seen:

2022-05-21 13:54:11 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 41 (65.85%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a3exdkps4u5gvzeoycek2fxr4ht7yc67kpczb4nxffk5vrhgx6ra._file

Verdict:

malicious

RedLineStealer

1af8db0f539323bebdcd8e72afa8e3a65e8f3950b2c9b59c771187662da1aa1c

RedLineStealer

27e68f07acdf0c9b4d7eef79073987ed8f84c467d8aee66ece4d79f321fc7c02

RedLineStealer

8752c84ad17a1e91baa4d124090654a3a5e00f6cd576c764583f52dfe6e92206

RedLineStealer

e78a7422032ae60dd8f4e84755f9508258a55ff571381446268966861165107a

RedLineStealer

+ 4'676 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:redline family:smokeloader botnet:3 backdoor infostealer trojan

Link:

https://tria.ge/reports/220522-l17t1shfd2/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Checks computer location settings

Downloads MZ/PE file

Executes dropped EXE

RedLine

RedLine Payload

SmokeLoader

Malware Config

C2 Extraction:

http://bahninfo.at/upload/
http://img4mobi.com/upload/
http://equix.ru/upload/
http://worldalltv.com/upload/
http://negarehgallery.com/upload/
http://lite-server.ru/upload/
http://piratia/su/upload/
http://go-piratia.ru/upload/
http://monsutiur4.com/
http://nusurionuy5ff.at/
http://moroitomo4.net/
http://susuerulianita1.net/
http://cucumbetuturel4.com/
http://nunuslushau.com/
http://linislominyt11.at/
http://luxulixionus.net/
http://lilisjjoer44.com/
http://nikogminut88.at/
http://limo00ruling.org/
http://mini55tunul.com/
http://samnutu11nuli.com/
http://nikogkojam.org/
https://ny-city-mall.com/search.php
https://fresh-cars.net/search.php
45.10.43.167:26696