MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1d7c3a08d1e69e704039850f64a88363fc6c9f3721907aa3c0d8165ae20de3a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 13
| SHA256 hash: | 1d7c3a08d1e69e704039850f64a88363fc6c9f3721907aa3c0d8165ae20de3a1 |
|---|---|
| SHA3-384 hash: | 8fa18e495ef8737bbc2892bf2cfeff826fa06d27b8dade100da59bd720ea59e1107475337513c011230b46327bd5a85c |
| SHA1 hash: | c267fb5e1d5bd1abd6b3d4d4faea91587b600586 |
| MD5 hash: | a485cb752e66e54c92ef00a9ae8f2eba |
| humanhash: | mike-three-friend-wolfram |
| File name: | a485cb752e66e54c92ef00a9ae8f2eba.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 6'678'362 bytes |
| First seen: | 2021-12-27 00:10:18 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | c05041e01f84e1ccca9c4451f3b6a383 (141 x RedLineStealer, 101 x GuLoader, 64 x DiamondFox) |
| ssdeep | 196608:JO/JcguSGnc1Cde5fPyTrYfhxG+Ghr1Dj:JQJF+nmCU5fe0rkB1Dj |
| Threatray | 1'672 similar samples on MalwareBazaar |
| TLSH | T11B6633056B70FDFAC6B39E31EF3593F1354D4A661A745208EB20A20D73AA136974CB39 |
| File icon (PE): |  |
| dhash icon | b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla) |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 147.135.248.206:22603 | https://threatfox.abuse.ch/ioc/287770/ |
| 185.215.113.85:13374 | https://threatfox.abuse.ch/ioc/287794/ |
| 95.216.16.44:19096 | https://threatfox.abuse.ch/ioc/287902/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
271
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DLInjector03
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
Searching for the window
Running batch commands
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Launching a process
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
chrome overlay packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Socelars
Verdict:
Malicious
Result
Threat name:
SmokeLoader Socelars Vidar
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Disables Windows Defender (via service or powershell)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Sigma detected: Powershell Defender Exclusion
Sigma detected: Shell32 DLL Execution in Suspicious Directory
Sigma detected: Suspicious Script Execution From Temp Folder
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Generic Downloader
Yara detected SmokeLoader
Yara detected Socelars
Yara detected Vidar stealer
Yara detected WebBrowserPassView password recovery tool
Yara Genericmalware
Behaviour
Behavior Graph:
Threat name:
Win32.Hacktool.NirSoftPT
Status:
Malicious
First seen:
2021-12-24 16:42:45 UTC
File Type:
PE (Exe)
Extracted files:
268
AV detection:
31 of 43 (72.09%)
Threat level:
1/5
Detection(s):
Malicious file
Verdict:
unknown
Similar samples:
+ 1'662 additional samples on MalwareBazaar
Result
Malware family:
vidar
Score:
10/10
Tags:
family:redline family:smokeloader family:socelars family:vidar botnet:915 botnet:userv1 aspackv2 backdoor discovery evasion infostealer spyware stealer trojan
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Looks up geolocation information via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
ASPack v2.12-2.42
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
NirSoft WebBrowserPassView
Nirsoft
Vidar Stealer
Modifies Windows Defender Real-time Protection settings
Process spawned unexpected child process
RedLine
RedLine Payload
SmokeLoader
Socelars
Socelars Payload
Vidar
Malware Config
C2 Extraction:
http://www.chosenncrowned.com/
https://mstdn.social/@kipriauk9
https://qoto.org/@kipriauk8
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
159.69.246.184:13127
https://mstdn.social/@kipriauk9
https://qoto.org/@kipriauk8
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
159.69.246.184:13127
Unpacked files
SH256 hash:
4f7016fb630595204b4cb47d03f4cdf9a75597d2586fa9bbd244a0407a567748
MD5 hash:
ec94b9dbbb8502ae096f9d7e1f33901c
SHA1 hash:
d5f73eaaa6df419e83bb2c58f30d28ba2e348b72
SH256 hash:
12f682423118581850910cddfb42e2ebb2851e4ec5c346c041f71a1dda51c057
MD5 hash:
029e5130789f584309502d7e23d6b3ec
SHA1 hash:
93f64300d51f9dbd6119c6aa4fdebecb44372758
SH256 hash:
e5652b5152dcbebf7b937cc011d066bdf36dea66fe8e24de7fa3dcc72ab1e9ca
MD5 hash:
7e4290c2f5b38bc8cf9482b88af9d3e3
SHA1 hash:
4b9bd173e7a7480b2faf3ee3e026319fa3f76850
SH256 hash:
ee2cc85a8e1972a29ce67ab0218d5daa8fc9b67f36111c71eccaf6da05219d19
MD5 hash:
f6271f82a952f96ba9271a4a27c9f22f
SHA1 hash:
d12708b9e39a0cd06add96316b65f1668d6a1246
SH256 hash:
384ac6605ab4c32981d01d7db34b05bca6cb936aaabd0c47f0c7d194d309c513
MD5 hash:
2818b130875193e0098be71ddd8fe49c
SHA1 hash:
ce1bd6b7eec9325b66d6485e4a744c40bdf154f8
SH256 hash:
dc36d3631189432fc1c1c52b84bca9a0755a5d6592669ef4a335f270d612832e
MD5 hash:
ea87eaa2e1949635de70792d17c4d40d
SHA1 hash:
c07342b31d48539720e6b53427cab544ea8e0da3
SH256 hash:
427bdb5bcc01bcb35de10396a523d40ccdf0d6f042120c1f4aac2422b44ec73f
MD5 hash:
fe1fa48096fccaf92d4cdf872247a832
SHA1 hash:
b8a7eaf9fb50481ff7c617163181fa2ef3cdc2f8
SH256 hash:
3c56025e4b133f4ed93144779638033d3e53272ff85e1f86a34497f9d83361b0
MD5 hash:
33f16f90796926ff4cfa3632a02c812c
SHA1 hash:
b72bbc9261b43bba488bba240bc7ce70b3038a04
SH256 hash:
25cad57db11d0122af6bd40d0032eab58c6323f611149491dc9a6d07cff96699
MD5 hash:
a4f7ea8e9a042d4e0db9abe1a9610f82
SHA1 hash:
b3ce927365a686b78111b81defe4dd7ebf124e35
SH256 hash:
12bee30a12d8d3741392001a46c63208d00b6d4f4b305f8c500d92a69b6b85fc
MD5 hash:
a0df958d82e7ea7d08e8526c30f18a3d
SHA1 hash:
a74ede615b7d99edbd2cdf4010ecfe69e861f361
SH256 hash:
d4b3eed33d0db4fc72fc425243341a560a772af9e8f979139c649fd3d4819787
MD5 hash:
d517736c4f13db1a70de3c81bf228825
SHA1 hash:
970df62d85166eec5e9ea5224273a38834c50de3
SH256 hash:
78441bc2ea4a8eee65c6ef2b36eceef7e3b6513f9ef35e10f262c16af070469d
MD5 hash:
dae328e2b7cee72b3dc4066250477e90
SHA1 hash:
95fd3d13653dcbee85d8f6fc36b7b519e0871540
SH256 hash:
6193f98c1c67c903e6c019454f3d042d258d4533e6db56e93d4176b033e11fbd
MD5 hash:
4a31a00a7422b3a11d90d473e4b61bb2
SHA1 hash:
6fb20bb4c0ca21245058c9800e3dd1d9850ed659
SH256 hash:
ebb4bff134da899f016871bead5aec03231cc9c06ce7fd7391a7fbdc10d47d35
MD5 hash:
0c5dfa52c4bb86f8ec3f7a3a4f13175f
SHA1 hash:
48a9fe30bb7607a013ae000e3f9ff4e0726e443a
SH256 hash:
36401f8287ed94b582e70fc97c5527a22276046581f797dc4dba5a4ec5c9177c
MD5 hash:
5e57e2a935f13368fade9a75347ef10f
SHA1 hash:
2b456e724a2143990db08e1738424049be195b2f
SH256 hash:
f45daafd61371b1f080a92eea8e9c8bfc9b710f22c82d5a06a1b1bf271c646ad
MD5 hash:
7e32ef0bd7899fa465bb0bc866b21560
SHA1 hash:
115d09eeaff6bae686263d57b6069dd41f63c80c
SH256 hash:
e1cc6a9d780602fe6e789bf5c3a27e87e197a4e3bf7c8138ea2f9dfec70fb963
MD5 hash:
f707252b9c9579677fffb013e0cfc646
SHA1 hash:
8ab483023fa8773afb8c13464c39c5b8e687f126
SH256 hash:
a7e37f5314834b163fa21557e61c13c0f202fd64d3c0e46e6c90d2d02e033aec
MD5 hash:
6faec01bf7a3d7f5c5dee2e6e3143a58
SHA1 hash:
603a36f817cab5574e58ab279379e5c112e5fb37
SH256 hash:
012c3d22b5374c4f595fcf1986bf2a67697f322f36e8bb6456809334f98f5781
MD5 hash:
8bacb64db8fb73308faefd14b863fd43
SHA1 hash:
c5bf54f8b9cc198d6d380f3ee7a74df2feadf32a
SH256 hash:
9dac78cf97a753e813b02cb654f076cdea03155bc9a98ed64ec248729ead52ec
MD5 hash:
29fa5c5ade39d4ae5a0f564949278923
SHA1 hash:
376051004220051779d97fcb44065a8724de370b
SH256 hash:
cf1ed8957d4825743d39f19529138de7131ca8f506440ddc1774f4640dffc599
MD5 hash:
ded1c6e8c89148495fc19734e47b664d
SHA1 hash:
3a444aeacd154f8d66bca8a98615765c25eb3d41
SH256 hash:
f94a49f7e9098caec29318488c6ee905bcfb2a5bf6e987305e03576b0da5c595
MD5 hash:
294856fef3e5664d6c4ab77bbdd1f4d2
SHA1 hash:
255d454b5dd344ea29e92e0f0f0ba6908790a6a8
SH256 hash:
a5cb08b5c9d66e3751795d06b6a15ccfe0f5c30519cd151ca46ba550696714d8
MD5 hash:
457ebf3cd64e9e5ee17e15b9ee7d3d52
SHA1 hash:
bd9ff2e210432a80635d8e777c40d39a150dbfa1
SH256 hash:
74114eb5ffaef072e796f4acae2c78a496231b109acf2d8fe882d2b5a2853ae7
MD5 hash:
44bf7cb40b9ddfc6a01c9754f24cc9ab
SHA1 hash:
389977eab723c414552062c586a1b817749d4493
SH256 hash:
db44e7f32881d06ee8114270ddd91313b8f0514f308da476161539b4f5b3d096
MD5 hash:
d3a763085458fc2e7e2796f0a1209687
SHA1 hash:
c1730cfdd200570279de96a501cd18466e53806c
SH256 hash:
564ea9a35311045d507cba6906dc7194283d3ac2c5f599cce6f7f1827e5f3654
MD5 hash:
dd1313351dbd6c171cad72da1aeb5239
SHA1 hash:
917d925b004abd88dce20e215a222da94a991409
SH256 hash:
838acf9a232b707811626e6f10e542f8d864301469fd0b17fc0c1d80618137f7
MD5 hash:
81182aeea2f6644750026704a4365f97
SHA1 hash:
1ac0a65aa73062acd4ffe4eb2fed8bb955895e56
SH256 hash:
dc17627cc1df6e907492ba2988da8ee822a4bf2844154375c0e07863040dc634
MD5 hash:
1e7f42cf6701b4d46a2fb05c653149d3
SHA1 hash:
84449ffb5981c6e5ccc3980e01f1904e7d339f28
SH256 hash:
46a7d40710a2c2bd494c6ae2a8f43d17df98ce1a6678a7808d50d8a9518e9e2d
MD5 hash:
d8ddc4dec197bd5e184f20bb23827134
SHA1 hash:
cff7999e6539e6a6be32796c7da2a2cc4e848508
SH256 hash:
1d7c3a08d1e69e704039850f64a88363fc6c9f3721907aa3c0d8165ae20de3a1
MD5 hash:
a485cb752e66e54c92ef00a9ae8f2eba
SHA1 hash:
c267fb5e1d5bd1abd6b3d4d4faea91587b600586
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.