MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a3eeb453ba4b4728d686d4c79b3131d5117f112ce48c024b694b148510de40e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a3eeb453ba4b4728d686d4c79b3131d5117f112ce48c024b694b148510de40e
SHA3-384 hash: 5e26952a02e932e741d3d240cd7395c7b1265aaadf16947f6335886aa938d2ded1d0e6da2b920a7b69d86022de6dee3f
SHA1 hash: d1d770b4e7b7dab43b74362ffcbf3aed81115c7c
MD5 hash: 51e44507c4d4459f9afb6304d926f4a7
humanhash: seventeen-ack-sink-july
File name:51e44507c4d4459f9afb6304d926f4a7.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:333'824 bytes
First seen:2021-12-26 08:26:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 98739c67eeb8bc24f0458b0e56f33db8 (9 x RedLineStealer, 1 x RaccoonStealer)
ssdeep 6144:NDwKHW8QtVwLrcgVtgHBt4Cm6XHi4pHxmFOI:NDweIVEcgVtgHBtFm63FRmF
Threatray 6'253 similar samples on MalwareBazaar
TLSH T15E647C10B7A0D035F5B352F489B9A274B92F7AA16B3891CB53D527EE96355E0EC3030B
File icon (PE):PE icon
dhash icon b6dacabecee6baa6 (72 x Stop, 68 x RedLineStealer, 55 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
37.9.13.195:23036

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
37.9.13.195:23036 https://threatfox.abuse.ch/ioc/287771/

Intelligence

File Origin
# of uploads :
1
# of downloads :
348
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
51e44507c4d4459f9afb6304d926f4a7.exe
Verdict:
Suspicious activity
Analysis date:
2021-12-26 08:29:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c98a3e2b-9bd4-4837-a03e-e68a9d908f66

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/216424/
Detection(s):
Win.Packed.Ulise-9917518-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
DNS request
Sending a custom TCP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching a process
Query of malicious DNS domain
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/3264/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionGetTickCount
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61c82759ec6c6c14a9f3c41b/reports/d3d1093e-25be-4223-b89b-3e4d40f3538d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/79f9e864-9b5f-4b97-be47-4c98c047a3eb
Result
Threat name:
RedLine SmokeLoader Tofsee Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/912914
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Regsvr32 Anomaly
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 545392 Sample: LmMElxhOmw.exe Startdate: 26/12/2021 Architecture: WINDOWS Score: 100 91 91.219.236.18, 80 SERVERASTRA-ASHU Hungary 2->91 93 194.180.174.41 MIVOCLOUDMD unknown 2->93 95 7 other IPs or domains 2->95 137 Malicious sample detected (through community Yara rule) 2->137 139 Antivirus detection for URL or domain 2->139 141 Antivirus detection for dropped file 2->141 143 19 other signatures 2->143 11 LmMElxhOmw.exe 2->11         started        14 bvszscmu.exe 2->14         started        16 gahvdse 2->16         started        18 4 other processes 2->18 signatures3 process4 signatures5 155 Contains functionality to inject code into remote processes 11->155 157 Injects a PE file into a foreign processes 11->157 20 LmMElxhOmw.exe 11->20         started        159 Detected unpacking (changes PE section rights) 14->159 161 Detected unpacking (overwrites its own PE header) 14->161 163 Writes to foreign memory regions 14->163 165 Allocates memory in foreign processes 14->165 23 svchost.exe 14->23         started        167 Machine Learning detection for dropped file 16->167 26 gahvdse 16->26         started        process6 dnsIp7 145 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 20->145 147 Maps a DLL or memory area into another process 20->147 149 Checks if the current machine is a virtual machine (disk enumeration) 20->149 28 explorer.exe 14 20->28 injected 101 parubey.info 185.215.113.58, 443, 49831 WHOLESALECONNECTIONSNL Portugal 23->101 103 microsoft-com.mail.protection.outlook.com 40.93.207.1, 25, 49825 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 23->103 151 System process connects to network (likely due to code injection or exploit) 23->151 153 Creates a thread in another existing process (thread injection) 26->153 signatures8 process9 dnsIp10 105 host-data-coin-11.com 28->105 107 amogohuigotuli.at 28->107 109 16 other IPs or domains 28->109 83 C:\Users\user\AppData\Roaming\gahvdse, PE32 28->83 dropped 85 C:\Users\user\AppData\Roaming\duhvdse, PE32 28->85 dropped 87 C:\Users\user\AppData\Local\Temp\F6A0.exe, PE32 28->87 dropped 89 12 other files (11 malicious) 28->89 dropped 169 System process connects to network (likely due to code injection or exploit) 28->169 171 Benign windows process drops PE files 28->171 173 Deletes itself after installation 28->173 175 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->175 33 9A69.exe 28->33         started        37 8FD8.exe 127 28->37         started        40 D93D.exe 4 28->40         started        42 3 other processes 28->42 file11 signatures12 process13 dnsIp14 75 C:\Users\user\AppData\Local\...\bvszscmu.exe, PE32 33->75 dropped 111 Detected unpacking (changes PE section rights) 33->111 113 Detected unpacking (overwrites its own PE header) 33->113 115 Machine Learning detection for dropped file 33->115 129 2 other signatures 33->129 44 cmd.exe 33->44         started        47 cmd.exe 33->47         started        49 sc.exe 33->49         started        57 3 other processes 33->57 97 file-file-host4.com 37->97 77 C:\Users\user\AppData\...\sqlite3[1].dll, PE32 37->77 dropped 79 C:\ProgramData\sqlite3.dll, PE32 37->79 dropped 117 Tries to harvest and steal browser information (history, passwords, etc) 37->117 131 2 other signatures 37->131 51 cmd.exe 37->51         started        99 45.9.20.149, 49822, 7526 DEDIPATH-LLCUS Russian Federation 40->99 119 Tries to detect sandboxes and other dynamic analysis tools (window names) 40->119 121 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 40->121 133 2 other signatures 40->133 123 Multi AV Scanner detection for dropped file 42->123 125 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 42->125 127 Maps a DLL or memory area into another process 42->127 135 3 other signatures 42->135 53 CEAD.exe 42->53         started        55 A4CA.exe 42->55         started        file15 signatures16 process17 file18 81 C:\Windows\SysWOW64\...\bvszscmu.exe (copy), PE32 44->81 dropped 59 conhost.exe 44->59         started        61 conhost.exe 47->61         started        63 conhost.exe 49->63         started        65 conhost.exe 51->65         started        67 timeout.exe 51->67         started        69 conhost.exe 57->69         started        71 conhost.exe 57->71         started        73 conhost.exe 57->73         started        process19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a3eeb453ba4b4728d686d4c79b3131d5117f112ce48c024b694b148510de40e/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-12-26 08:27:16 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bi7owrj3us2hfdlinvghtmytdvirp4iszzemajfwssyuquin4qha._file
Verdict:
malicious
Similar samples:
0f9b30402f73d225631915acc66cfd6fa860e4050aa7db8e24b111dcb407dc35
RedLineStealer
3d9ebf871e9ada91551158af5078da769ca8bea4014afcd75472deb0d4beb538
RedLineStealer
4883c8f935d8c8397ffb003f72e4e515501820ebd37ca079c478ba5b7ed7b3d4
RedLineStealer
517836d1bd7e3ad8653520e36336e541d1a3d696f80554c00d43848a66cba9db
RedLineStealer
65350ee5de866f54845c13472cc7e0257b55715560ff9696ba2d4dc0494991e6
RedLineStealer
79b453329e50b1536decaaacae246fb5f1725c66e228852bf8ae16b2ae722a04
RedLineStealer
8a05e6ef4f863b73ec09200c5a19c68e5107bfc0de895ca22ecf1018ea9d4c89
RedLineStealer
8a9c79cd2bf3fb8f4b4f588829f45057272aa2c10ad92a08208a635d0d048c3e
RedLineStealer
b554190fa5cf3c176bf3372cf00a6ca84a66a0bdb0f44071c9019f3db31d4c2a
RedLineStealer
b88bcea5dc66a76f3c12117a8a9d1d699b1267d38db666dde881effd96467d0f
RedLineStealer
+ 6'243 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:arkei family:raccoon family:redline family:smokeloader family:tofsee family:xmrig botnet:1 botnet:10da56e7e71e97bdc1f36eb76813bbc3231de7e4 backdoor collection discovery evasion infostealer miner persistence spyware stealer trojan
Link:
https://tria.ge/reports/211226-kce9esbda5/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Checks SCSI registry key(s)
Checks processor information in registry
Delays execution with timeout.exe
Enumerates physical storage devices
Program crash
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Arkei Stealer Payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
XMRig Miner Payload
Arkei
Raccoon
RedLine
RedLine Payload
SmokeLoader
Tofsee
Windows security bypass
xmrig
Malware Config
C2 Extraction:
http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
parubey.info
patmushta.info
86.107.197.138:38133
Unpacked files
SH256 hash:
196c516ea546fb935ac669681a74a4dc80da79d9088f464f6cc6f126ae934f4e
MD5 hash:
c36de8bc9668ec4eaafca4c349dca0d5
SHA1 hash:
ea2cadfada69b93ca3abeb8b2462c5c18891fabf
Link:
https://www.unpac.me/results/58a47c41-10eb-4a0b-94e1-9e043c75ed60/
Parent samples :
6b2d7c8bdedb901d80c89717c9889abf169c9059d8bb545af6ca1960660324ad
8928eed86ea55a63e3646bf8ca403b4b1e57702f73c1ecc8fa403b5700a304ef
18ad362dcae8df5827846223c09ceba7766e09733b685d4067ee39037daec452
da39948d95cdbce6e1ca9e0fdbb77080164a379f593e530b5732d3fc38df7bf8
7c74a8c41e24f69015185f78b8fbc177edcbe9d27099e904497b2310999f74cb
92ebb6be19502fe2573a9eac183bcc657b88ac5b0344285d9db409b0a3d88dab
af6fa095b427a0e95dd826696c2b92b0123e688e3c95f6d27825cc2928085d1b
de8099732ee5b73f3fa6d032a74e8576d06663fc16b2c6da27a34444fdced1c8
SH256 hash:
0a3eeb453ba4b4728d686d4c79b3131d5117f112ce48c024b694b148510de40e
MD5 hash:
51e44507c4d4459f9afb6304d926f4a7
SHA1 hash:
d1d770b4e7b7dab43b74362ffcbf3aed81115c7c
Link:
https://www.unpac.me/results/58a47c41-10eb-4a0b-94e1-9e043c75ed60/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0a3eeb453ba4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a3eeb453ba4b4728d686d4c79b3131d5117f112ce48c024b694b148510de40e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 0a3eeb453ba4b4728d686d4c79b3131d5117f112ce48c024b694b148510de40e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1902535/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1886977/
Cape
Cape
https://www.capesandbox.com/analysis/216424/

Comments