MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19417eff67a1da9047ec0a2eee73cfcf5b0d5fa16178802b3f52916b683419f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 13

Intelligence 13 IOCs 1 YARA File information Comments

SHA256 hash:	19417eff67a1da9047ec0a2eee73cfcf5b0d5fa16178802b3f52916b683419f0
SHA3-384 hash:	c2cc755d30ac86786b39f20f806c8e59cf5f35d751e072e8888b6ee39df908ea6b86fbc44d7817d8eea63aa5380a2d8e
SHA1 hash:	65004059f4a8e613f3932a9a41964e114193c576
MD5 hash:	4f698342069961d717921cc2d492894f
humanhash:	golf-batman-bravo-carpet
File name:	4f698342069961d717921cc2d492894f.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	258'048 bytes
First seen:	2022-05-22 10:05:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ff73af34ee751941b50825bbffa6e682 (3 x RedLineStealer)
ssdeep	3072:2xLwmu37JEyqsVl37CbsxWsbtbuwGFsxkgaBChUpZa9uD6Vdyhk:2hbaJEyqsVl7Cb3sBqWiga3wVf
Threatray	16'105 similar samples on MalwareBazaar
TLSH	T12544BF01F2D0C871E5621D308831C6F9573BF862A974950BF7947B6F2EB33909AB6326
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	5c599a3c60c3c850 (20 x RedLineStealer, 14 x Stop, 13 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
141.255.161.70:81

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
141.255.161.70:81	https://threatfox.abuse.ch/ioc/623370/

Intelligence

File Origin

# of uploads :

# of downloads :

319

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

4f698342069961d717921cc2d492894f.exe

Verdict:

No threats detected

Analysis date:

2022-05-22 10:07:57 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ad6682fc-6eb9-49aa-8843-b4b5b0295e94

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/273398/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending a UDP request

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/19516/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

CheckCmdLine

EvasionGetTickCount

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed ransomware redline

Link:

https://www.filescan.io/uploads/628a0b48054dcf0ecadceb9f/reports/e06eb9a6-6bc0-46c0-816f-4bf6414e2072/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2dbffe0b-f087-4480-8034-863e8472f276

Result

Threat name:

RedLine, SmokeLoader

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/999290

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to infect the boot sector

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/19417eff67a1da9047ec0a2eee73cfcf5b0d5fa16178802b3f52916b683419f0/

Threat name:

Win32.Trojan.PSWStealer

Status:

Malicious

First seen:

2022-05-20 23:11:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 26 (92.31%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dfax573huhnjar7mbixo446pz5nq2x5bmf4iakz7kkiww2budhya._file

Verdict:

malicious

RedLineStealer

0852f2acf49f4d4bb697bcc3918773c57d0259025f8c424f2987d331d507ac4d

RedLineStealer

27e68f07acdf0c9b4d7eef79073987ed8f84c467d8aee66ece4d79f321fc7c02

RedLineStealer

2ed02cabdb5f2d169cb838c2a79e1d64e7bc54f809aef2087fbc96ae1b822e70

RedLineStealer

4819ff853b534e12c7460dd478d5d60c236885e23338af9e60e42ef226b360de

RedLineStealer

e78a7422032ae60dd8f4e84755f9508258a55ff571381446268966861165107a

RedLineStealer

+ 16'095 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/220522-l43dpshfe7/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://bahninfo.at/upload/
http://img4mobi.com/upload/
http://equix.ru/upload/
http://worldalltv.com/upload/
http://negarehgallery.com/upload/
http://lite-server.ru/upload/
http://piratia/su/upload/
http://go-piratia.ru/upload/
http://monsutiur4.com/
http://nusurionuy5ff.at/
http://moroitomo4.net/
http://susuerulianita1.net/
http://cucumbetuturel4.com/
http://nunuslushau.com/
http://linislominyt11.at/
http://luxulixionus.net/
http://lilisjjoer44.com/
http://nikogminut88.at/
http://limo00ruling.org/
http://mini55tunul.com/
http://samnutu11nuli.com/
http://nikogkojam.org/
https://ny-city-mall.com/search.php
https://fresh-cars.net/search.php