MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e4b2af07cb9e6478dbf5051e1839a1f944e950a6f2dbadc94446928e46e7d45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e4b2af07cb9e6478dbf5051e1839a1f944e950a6f2dbadc94446928e46e7d45
SHA3-384 hash: 9c11272beed5602e455e32ff6e76995a178150359936314bc11be116f4ca85f3ad811a65828110c4bdb8c8db1295073e
SHA1 hash: f3bee20db3275d737e18a28f9020379e73e5a226
MD5 hash: fa9abc629c67c188f165366e2fe30971
humanhash: venus-steak-idaho-cat
File name:1E4B2AF07CB9E6478DBF5051E1839A1F944E950A6F2DB.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:4'429'143 bytes
First seen:2022-02-05 00:15:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 32569d67dc210c5cb9a759b08da2bdb3 (122 x RedLineStealer, 42 x DiamondFox, 37 x RaccoonStealer)
ssdeep 98304:xKCvLUBsgGUCDirYz+wxR8ro9hcBsVsbv2IeDBIQ6JAcp1:xLLUCgGGYSwR8roQBsVsTteVIQ6T1
Threatray 2'319 similar samples on MalwareBazaar
TLSH T1552633527FE6E5FBCE0726310B1C6B71B2F9C3590B16419B338499285F2DAFAD12B424
File icon (PE):PE icon
dhash icon 848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
5.188.168.132:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
5.188.168.132:80 https://threatfox.abuse.ch/ioc/379316/

Intelligence

File Origin
# of uploads :
1
# of downloads :
293
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1E4B2AF07CB9E6478DBF5051E1839A1F944E950A6F2DB.exe
Verdict:
No threats detected
Analysis date:
2022-02-05 00:19:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6e1083ca-0ce6-4cad-afa8-09184f70c7c9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/233474/
Detection(s):
Win.Packed.Barys-9859531-0
Create hunting rule

Win.Malware.Generic-9863888-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Win.Packed.Socelars-9901323-1
Create hunting rule

Win.Packed.Socelars-9901325-1
Create hunting rule

Win.Packed.Socelars-9901373-1
Create hunting rule

Win.Malware.Socelars-9901376-1
Create hunting rule

Win.Packed.Socelars-9901382-1
Create hunting rule

Win.Malware.Socelars-9901386-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Searching for the window
Running batch commands
Sending a custom TCP request
Searching for synchronization primitives
Launching a process
Launching the default Windows debugger (dwwin.exe)
Creating a process with a hidden window
Creating a window
DNS request
Launching cmd.exe command interpreter
Query of malicious DNS domain
Unauthorized injection to a recently created process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/6021/overview
Behaviour
MalwareBazaar
CheckCmdLine
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Socelars
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1a4be27c-9236-4175-ad57-2e1bedf6ddf3
Result
Threat name:
Socelars
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/934389
Signature
.NET source code contains very large array initializations
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Socelars
Yara Genericmalware
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-10-03 00:19:00 UTC
File Type:
PE (Exe)
Extracted files:
132
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dzfsv4d4xhtepdn7kbi6da42d6ke5fikn4w3vxeuirusrzdopvcq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
ryuk
Create hunting rule
Similar samples:
0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a
RedLineStealer
1e4b2af07cb9e6478dbf5051e1839a1f944e950a6f2dbadc94446928e46e7d45
RedLineStealer
2992c4b00c678a438b0b935e09e0fd341a44c46fe0dd2f18621570f55133e4df
RedLineStealer
44e401aaf0b52528aa033257c1a1b8a09a2b10edf26edaafcef0f45a2c40e885
RedLineStealer
5aeeb53a492389bfaaa1a2d15b98324c159ded6cd2e55dd67efb3eba6e4ee270
RedLineStealer
6e52d162baf265e070ec1a3147ad651d8bd8481d96b33cee1b89d84e9c92c5f3
RedLineStealer
70e14ddf23a5fe3d69cc50752fcc491aa2964a2cfee3d48caf182244929f9953
RedLineStealer
8eb464ddff8d1b4844641e7e1eefdcb9cd5830a3e63d19fe0c061db6a21b4405
RedLineStealer
+ 2'309 additional samples on MalwareBazaar
Result
Malware family:
socelars
Create hunting rule
Score:
  10/10
Tags:
family:redline family:socelars botnet:ani botnet:jamesoldd aspackv2 evasion infostealer spyware stealer suricata trojan
Link:
https://tria.ge/reports/220205-akggcagabm/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Kills process with taskkill
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in System32 directory
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Looks up geolocation information via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
ASPack v2.12-2.42
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Defender Real-time Protection settings
Process spawned unexpected child process
RedLine
RedLine Payload
Socelars
Socelars Payload
Suspicious use of NtCreateUserProcessOtherParentProcess
suricata: ET MALWARE ClipBanker Variant Activity (POST)
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
Malware Config
C2 Extraction:
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.znsjis.top/
65.108.20.195:6774
45.142.215.47:27643
Unpacked files
SH256 hash:
393447aa843f148cd22e887d1eda74062785f0b4a6f098fbcb0d024b5aa23e4e
MD5 hash:
07f99f9e2df157ae78339603186ac280
SHA1 hash:
cb295687ae130d85061676471abcaa5f60df4198
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
972c33057d6944870e2fe26b4a5f2497cde0b540150386bdba04c8fc607f4b01
MD5 hash:
d5d68f6d0c6e151d2fb689740f5f3f75
SHA1 hash:
cb5ef9eb004073daba0eb683f1ff69d1dd5f21eb
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
Parent samples :
f33c9c6f077b7fb4d243925fe48b875581bb8af46e452b39bd4a2c3dd68f0ef9
822ee6c4b4bb9a619985e83c04a2dfe1a09152dc0276bd698f6d03be6ec7b83a
cfcab36f73560b2d15b6c266feaaf0195a6e0d18c22aa22b672e7eb2f979923e
7287980c1afb840a7438471126c0c95c36fefa79a013f9620264507e5f98c7a6
f9c9b3fbf4d11f96ff06fc8292d8c67ad6cf5432409754bbfc95c5c80e6b160d
72b6da82c3aa6faeee19e842814f77874cab37b3425ce6c503754b90c43a4610
e4fb39b3f6aa19028ccdd531437e7994a9b6f62b317adfa3edc16ba51e57acb1
582bd655f491fe76a95b9c8900a3051d379dcbb86036f273b2a7bc6cdd928e9b
9265b09595c59007e116c60605c28bd616387cf0dff79c7db8c5880e23cfef8e
abc0f6a2936703cd32608e7a0c06cd7b1da2f012ad7eb6bd2120da1c01fb1a5a
SH256 hash:
e427f8ef21691e3d8c2313d11129ad08ddef69a158eca2f77c170603478ff0c4
MD5 hash:
0dedd909aae9aa0a89b4422106310e9e
SHA1 hash:
271d36afa5b729ee590cf8066166ca5e9c9d0340
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
d1417ebebd174d666a6abc9481d65b39fc2d88559f7fd92ebb7e2f1ae93787db
MD5 hash:
70220a3ce6ffd34101b3770342505f2c
SHA1 hash:
b55c421634d8eeaec5c6193f34c04625d21a9ae9
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
bffb5e0da99f01972d746d4bf68765ca7db0fb32e598f8fd9a92e8389f321c1f
MD5 hash:
417411e71de543ffbe76242943ba5b90
SHA1 hash:
e50f45218c6d01cb67787add25491acfead007fa
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
e8e4cb96f958e7205a90052f13cdf0d63f0018345152eb4ef552b8d796481cee
MD5 hash:
57e3a53d7576635f94c0b7ea6b9fad43
SHA1 hash:
a43b28cd48d9efcbccc12ad2a644d6186acbd968
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
70f246fd61a27a4e2ffde2357e6c8ebe554a79811a35e7141f747090d05ff7e1
MD5 hash:
51b73b4d3041eb2d32a29dca61059549
SHA1 hash:
9845a8e5716e5e16ffc33ceccae9abf52872a2b5
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
ad359d8d11cdc4883f7de0629f18a2802777d9534cf894278300f35e433967e4
MD5 hash:
c2a3cf87d9a3d247431054d260d56fcd
SHA1 hash:
94938f4c7eae4f872ef4b3bfeca3fd29d21d5f54
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
87a9a01f415c3fbe68604be6674ab2f4b6104db0bb21c5273610a4621a962b82
MD5 hash:
6e8c9d63e8ab299be3c53fcc870c0348
SHA1 hash:
86e4f9a86b44819c9d1401efcc7dded6f496c83d
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
728e91bd23b6f987109a9c04ac8cbd6ce73e23cec5d5b4c129dbb109255a54cd
MD5 hash:
d378f14fa33a80d724273450475df6f6
SHA1 hash:
28a88a1ecbde308d7361528f568b537e3c2e196e
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
e44ea3867d4f177bb2a78af566933b4eca8c108231032abc17836c45499f9c7c
MD5 hash:
6fc6f704fc21e2edfdff0408f4b8864a
SHA1 hash:
1e632e628ed41284a1a24d0dc93760f5df036d45
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
9521eea2210b33a29a99aa5dd486c7dd0b4d1e1ef5af29d899da409e8dad48c3
MD5 hash:
11ea67f17b350e456cf89cd107831613
SHA1 hash:
1ab4408dd09e23c6ea5aef5022db9ff22572f3fc
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
0bb9bb0248ff89fac4e513cc1891f8aabbcc076446790c68d849e5a6c007c1ca
MD5 hash:
2fbf0040b06b8719902326d9584c29c3
SHA1 hash:
f2983c7b2d3d91722fb88198ac2441c5e098c2cf
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
450316cde8a53c5f3092cef320997b942eb48108dcdc037660499b93a43f40e5
MD5 hash:
abe213198e2254d389e5c81b371885dd
SHA1 hash:
c24b34e74887b55bf784490966a3e8931b5d4fcc
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
bc945e03237641e79cb1a9b5399fffafce68daa318430e959b701aa3f4628c05
MD5 hash:
5275ae278e347d83fb061a92e979fe86
SHA1 hash:
6c1118b87f366df72a25f1988f740ea6753984cd
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
cc40fc4502d705d9698fd9d9493efdd39f6fcd0f0e03678eef29773b80e51ff9
MD5 hash:
bf8b0c8e992a344ce312c8a939fa1c9e
SHA1 hash:
3e207a18a539ab6ec17737e6fe79562f59502718
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
2cf67278ce63932f7efabdee1be667555c408718fca6622de2456b8e59db69cf
MD5 hash:
7b9e5d37881a3e58e26e22c79de09d47
SHA1 hash:
0cf699c041c6f7ad485b77f25403776aab99c057
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
48716fb6b524351ce2d7bc539138e914a56a286914dccfb09afaa73d83b399bd
MD5 hash:
5ecff1260eabf861d06d5ed6fee8d75a
SHA1 hash:
a4ad41887bf736b41942bd9e525ebad6db13eb6e
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
bbeb794046d4453d0dceb6562699d50f555d516164291a4f0d1ca1cc3eaf3e30
MD5 hash:
85dfa6ffd168f89cba8179c4b3615367
SHA1 hash:
584a93662c821e8b88d4cd9bc4e47376f31794c5
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
52acf08a125a1c2f83eab82a7aac60decb8810a46cb3cd3d6343660a8735be8d
MD5 hash:
4b4605514ce541095d6851e6becd4dc2
SHA1 hash:
6f9e1ab6652b610bf6fd2d1f97b5189d56ba4e5c
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
fd29d11344d697a1a61168afb9f5b5fca46d3d89e19f347e4992b7a0ae13af41
MD5 hash:
a376539aa5cf713640e9c85a1c4a492a
SHA1 hash:
e2d512c8fc8a7701a71a5a86dae752d874b95285
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
SH256 hash:
1e4b2af07cb9e6478dbf5051e1839a1f944e950a6f2dbadc94446928e46e7d45
MD5 hash:
fa9abc629c67c188f165366e2fe30971
SHA1 hash:
f3bee20db3275d737e18a28f9020379e73e5a226
Link:
https://www.unpac.me/results/cefc2c9e-72eb-4f06-a83b-b6c7806375f4/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1e4b2af07cb9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1e4b2af07cb9e6478dbf5051e1839a1f944e950a6f2dbadc94446928e46e7d45

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/233474/

Comments