MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b8192ec7f52e9056f5f2c83f0a9c56c83469575fded613e6ae7c1f3505a3c1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b8192ec7f52e9056f5f2c83f0a9c56c83469575fded613e6ae7c1f3505a3c1d
SHA3-384 hash: 930cf3ce5470d48ee7d7c0216e50c6ff8d624e2ce67cab0c21106c4ad2a913cd65a423c0b58cc0f1ee06ce904d8fad34
SHA1 hash: 66554d44efbefccc638fe410e401287f78e740c5
MD5 hash: 6143f1d8c3adde1d7024c497fa46922c
humanhash: charlie-kansas-jig-mountain
File name:6143f1d8c3adde1d7024c497fa46922c.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:296'960 bytes
First seen:2022-01-09 19:15:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7e7dada750fd85eb5f5f9954ddaa9f24 (4 x RedLineStealer, 1 x CoinMiner.XMRig, 1 x RaccoonStealer)
ssdeep 3072:S6WxqLUIqdWlfXtJLPEJcXeTUpl0SNVnWrxpzbgqruJ3fed:1WxqLU4JXHLPEurl0IRuzbgwuJ2
Threatray 647 similar samples on MalwareBazaar
TLSH T1B954C030F9E9C879C46B45714821CAE46F3A78321A65834B3B75076E7E30F9C86E635E
File icon (PE):PE icon
dhash icon fcfcf4d4d4d4d8c0 (41 x RedLineStealer, 30 x RaccoonStealer, 9 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
45.9.20.101:23970

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.9.20.101:23970 https://threatfox.abuse.ch/ioc/292069/

Intelligence

File Origin
# of uploads :
1
# of downloads :
370
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6143f1d8c3adde1d7024c497fa46922c.exe
Verdict:
Suspicious activity
Analysis date:
2022-01-09 19:18:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/895ced9a-1339-452a-b829-93146640d395

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/217930/
Detection(s):
Win.Malware.Mikey-9917879-0
Create hunting rule

Win.Packed.Lockbit-9919158-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
DNS request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Searching for synchronization primitives
Using the Windows Management Instrumentation requests
Reading critical registry keys
Searching for the window
Searching for analyzing tools
Running batch commands
Launching a process
Launching the default Windows debugger (dwwin.exe)
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/3943/overview
Behaviour
MalwareBazaar
MeasuringTime
CPUID_Instruction
SystemUptime
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
mikey
Link:
https://www.filescan.io/uploads/61db347602e388f9fdbb347a/reports/5879a6d6-1e28-4e9a-bc5d-c3118b692d14/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/677cce2a-6f17-4cac-ae21-85821305d29e
Result
Threat name:
RedLine SmokeLoader Tofsee Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/917378
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Found API chain indicative of debugger detection
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Query firmware table information (likely to detect VMs)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade analysis by execution special instruction which cause usermode exception
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 549852 Sample: NmImkV53Fq.exe Startdate: 09/01/2022 Architecture: WINDOWS Score: 100 81 patmushta.info 2->81 83 mstdn.social 2->83 85 2 other IPs or domains 2->85 129 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->129 131 Multi AV Scanner detection for domain / URL 2->131 133 Found malware configuration 2->133 135 18 other signatures 2->135 11 NmImkV53Fq.exe 2->11         started        13 ndnpbkbg.exe 2->13         started        16 rssubra 2->16         started        18 wjsubra 2->18         started        signatures3 process4 signatures5 20 NmImkV53Fq.exe 11->20         started        157 Detected unpacking (changes PE section rights) 13->157 159 Detected unpacking (overwrites its own PE header) 13->159 161 Found API chain indicative of debugger detection 13->161 169 3 other signatures 13->169 23 svchost.exe 1 13->23         started        163 Multi AV Scanner detection for dropped file 16->163 165 Machine Learning detection for dropped file 16->165 167 Maps a DLL or memory area into another process 16->167 171 2 other signatures 16->171 26 wjsubra 18->26         started        process6 dnsIp7 137 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 20->137 139 Maps a DLL or memory area into another process 20->139 141 Checks if the current machine is a virtual machine (disk enumeration) 20->141 28 explorer.exe 6 20->28 injected 91 patmushta.info 92.53.104.167, 443, 49901, 49936 TIMEWEB-ASRU Russian Federation 23->91 93 microsoft-com.mail.protection.outlook.com 104.47.54.36, 25, 49892 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 23->93 95 192.168.2.1 unknown unknown 23->95 143 System process connects to network (likely due to code injection or exploit) 23->143 145 Found API chain indicative of debugger detection 23->145 147 Creates a thread in another existing process (thread injection) 26->147 signatures8 process9 dnsIp10 97 host-data-coin-11.com 28->97 99 185.233.81.115, 443, 49808 SUPERSERVERSDATACENTERRU Russian Federation 28->99 101 18 other IPs or domains 28->101 71 C:\Users\user\AppData\Roaming\wjsubra, PE32 28->71 dropped 73 C:\Users\user\AppData\Roaming\rssubra, PE32 28->73 dropped 75 C:\Users\user\AppData\Local\Temp\FC90.exe, PE32 28->75 dropped 77 9 other malicious files 28->77 dropped 173 System process connects to network (likely due to code injection or exploit) 28->173 175 Benign windows process drops PE files 28->175 177 Deletes itself after installation 28->177 179 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->179 33 4E51.exe 28->33         started        36 41BA.exe 28->36         started        38 D678.exe 28->38         started        41 5 other processes 28->41 file11 signatures12 process13 dnsIp14 103 Multi AV Scanner detection for dropped file 33->103 105 Contains functionality to inject code into remote processes 33->105 107 Injects a PE file into a foreign processes 33->107 44 4E51.exe 33->44         started        109 Detected unpacking (changes PE section rights) 36->109 111 Machine Learning detection for dropped file 36->111 113 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 36->113 125 3 other signatures 36->125 89 185.7.214.239, 49921, 80 DELUNETDE France 38->89 115 Query firmware table information (likely to detect VMs) 38->115 117 Tries to detect sandboxes and other dynamic analysis tools (window names) 38->117 127 4 other signatures 38->127 69 C:\Users\user\AppData\Local\...\ndnpbkbg.exe, PE32 41->69 dropped 119 Detected unpacking (overwrites its own PE header) 41->119 121 Uses netsh to modify the Windows network and firewall settings 41->121 123 Modifies the windows firewall 41->123 47 cmd.exe 1 41->47         started        50 6DEB.exe 41->50         started        53 netsh.exe 3 41->53         started        55 4 other processes 41->55 file15 signatures16 process17 dnsIp18 149 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 44->149 151 Maps a DLL or memory area into another process 44->151 153 Checks if the current machine is a virtual machine (disk enumeration) 44->153 155 Creates a thread in another existing process (thread injection) 44->155 79 C:\Windows\SysWOW64\...\ndnpbkbg.exe (copy), PE32 47->79 dropped 57 conhost.exe 47->57         started        87 86.107.197.138, 38133, 49910 MOD-EUNL Romania 50->87 59 conhost.exe 53->59         started        61 conhost.exe 55->61         started        63 conhost.exe 55->63         started        65 conhost.exe 55->65         started        67 conhost.exe 55->67         started        file19 signatures20 process21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b8192ec7f52e9056f5f2c83f0a9c56c83469575fded613e6ae7c1f3505a3c1d/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-01-09 19:16:10 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=doazf3d7kluqk327fsb7bkofnsbunflv7xwwcptk47a7guc2hqoq._file
Verdict:
malicious
Similar samples:
1bbee1727c791557b1119c32a93c58964414a1cce3dcc0601f92bb628e033a59
RedLineStealer
2d85c3c393acd49f3d6a4bf20c80936788d9ed56b4fc63c07f92fad0e4849b30
RedLineStealer
4b35e095909d55419ed46df3f815f3353de28fe3092e64914f89152ea9306d6f
RedLineStealer
61837eb9320780523b73477707156a0351b09d83d511f0b28f64ede3eec65e87
RedLineStealer
63680cb50ca4c6ec5837dbc45a9a58f9b27fd33fb47e37e4e848225d0d0a1f2f
RedLineStealer
92ccbbead3ca1c2a221c3dd06da16bb15fe6aef02859087c09c7d248017d955d
RedLineStealer
932fda59abbce6378d0637c359b61b0747c9602e2e87d3105bb49ad745ed382e
RedLineStealer
b1639975ad1d3f9da541095c77e375e5bae1081eb1efa225525b23bbf992b210
RedLineStealer
+ 637 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:arkei family:loaderbot family:raccoon family:smokeloader family:tofsee family:xmrig backdoor collection discovery evasion loader miner persistence spyware stealer suricata trojan upx
Link:
https://tria.ge/reports/220109-xyssvseacq/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Modifies registry class
Script User-Agent
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: LoadsDriver
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Checks BIOS information in registry
Deletes itself
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
UPX packed file
Arkei Stealer Payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
LoaderBot executable
XMRig Miner Payload
Arkei
LoaderBot
Raccoon
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
Tofsee
Windows security bypass
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
xmrig
Malware Config
C2 Extraction:
http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
patmushta.info
parubey.info
Unpacked files
SH256 hash:
721d393191597d49d856baef2fbde75e48f52d0465e2cfabf1a41848b0e05589
MD5 hash:
b984a027c8a2abf874f3eb306a831613
SHA1 hash:
d3b3f8890adc840b0bd411cf304eef15d415ed48
Link:
https://www.unpac.me/results/7ae333c4-08d0-4542-9a39-fbb74d3e6ee2/
Parent samples :
fb9b41efdc7c2d9e8cfda4be223831a9d2f4d21366759da64e04bbbb9e662766
bc9d49f4f0d51c57b34515616d5e6a23a37fec03f8884d8305db0806bd6138fc
ecb96fec4db4a1eecef04c8ef12b260bb419407111c1263664749481b7fa5387
98c920233869ce802fb4722f982fc1a8c2461e2a01ea4a619a9532a660acf285
2fde1682e006e27b2deb49595ab3baf37a836577fbe9efdfae59d4b6b682d8b7
2374069183727dd5904a26027c80032f30dcff60d25019578876c0b37fa9c224
bd3030832602591f05fe01ef11feaa3b9fe776b2a184eb454f02cae3ab73340b
a0f15f4665835bb7f3b07d5e96d2b08af8e88614c9b22fc9fff86f4f60ee1a8e
c91dec1cd5b97079481c76d5d597dde67b60c301ea900eab7db99776d52b465a
SH256 hash:
1b8192ec7f52e9056f5f2c83f0a9c56c83469575fded613e6ae7c1f3505a3c1d
MD5 hash:
6143f1d8c3adde1d7024c497fa46922c
SHA1 hash:
66554d44efbefccc638fe410e401287f78e740c5
Link:
https://www.unpac.me/results/7ae333c4-08d0-4542-9a39-fbb74d3e6ee2/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1b8192ec7f52/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1b8192ec7f52e9056f5f2c83f0a9c56c83469575fded613e6ae7c1f3505a3c1d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 1b8192ec7f52e9056f5f2c83f0a9c56c83469575fded613e6ae7c1f3505a3c1d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1950845/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1928874/
Cape
Cape
https://www.capesandbox.com/analysis/217930/

Comments