MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31199c08dabb68fd3b693528ba7803890acdea14125bb6bb8b938293da3d4666. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31199c08dabb68fd3b693528ba7803890acdea14125bb6bb8b938293da3d4666
SHA3-384 hash: f593cdd8dd1b5fec9dfe5f0e837ebc3fa3e4b2e53c67e9e152ef476421e2acfb1970014d5dbf597dcea885268e576883
SHA1 hash: ab28a8300bed35ed80a72417fb516dfb4ba38abf
MD5 hash: 8386a21536fce0fb742287a2e4aad9fc
humanhash: fix-april-louisiana-solar
File name:8386a21536fce0fb742287a2e4aad9fc.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:172'544 bytes
First seen:2021-11-19 18:21:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9f36e28e95ecac65660050c1a70ebbaa (4 x RedLineStealer, 3 x Smoke Loader, 1 x CryptBot)
ssdeep 3072:n7M4Kqw7Vg5AfRbbdOWya4tynnMMiRqXfz44pV+ODGu:wQAfRbbdggY0fsMi
Threatray 2'663 similar samples on MalwareBazaar
TLSH T1FAF3AE9237E2C472D5E31632E4709FE15A7BB832A770418B2764272E5E713E08AB5F53
File icon (PE):PE icon
dhash icon fcfcb4f4d4d4d8c8 (8 x RedLineStealer, 6 x RaccoonStealer, 4 x ArkeiStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
146.185.239.5:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
146.185.239.5:80 https://threatfox.abuse.ch/ioc/251032/

Intelligence

File Origin
# of uploads :
1
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8386a21536fce0fb742287a2e4aad9fc.exe
Verdict:
No threats detected
Analysis date:
2021-11-19 18:28:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4fe627c2-fcd8-4e5e-a2c5-a92501231185

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Searching for synchronization primitives
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Sending an HTTP POST request
Reading critical registry keys
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6197eb4a43e8f62b669ac1ea/reports/0cd23784-b2be-4508-8652-06b0597a704c/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/527b8697-a75c-49b6-8c36-04e4c01476e1
Result
Threat name:
Clipboard Hijacker Raccoon RedLine Smoke
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/892852
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to infect the boot sector
Creates a thread in another existing process (thread injection)
Delayed program exit found
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Performs DNS queries to domains with low reputation
Sigma detected: Bypass UAC via CMSTP
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Clipboard Hijacker
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 525325 Sample: omcGgJwKl5.exe Startdate: 19/11/2021 Architecture: WINDOWS Score: 100 71 jaromawanave.xyz 2->71 73 cdn.discordapp.com 2->73 75 api.ip.sb 2->75 83 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->83 85 Multi AV Scanner detection for domain / URL 2->85 87 Antivirus detection for URL or domain 2->87 89 18 other signatures 2->89 9 omcGgJwKl5.exe 2->9         started        12 urewbai 2->12         started        14 A4DF.exe 2->14         started        17 2328.exe 2->17         started        signatures3 process4 file5 99 Detected unpacking (changes PE section rights) 9->99 101 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 9->101 103 Maps a DLL or memory area into another process 9->103 105 Creates a thread in another existing process (thread injection) 9->105 19 explorer.exe 6 9->19 injected 107 Multi AV Scanner detection for dropped file 12->107 109 Machine Learning detection for dropped file 12->109 111 Checks if the current machine is a virtual machine (disk enumeration) 12->111 61 b2fa1912-a117-45be-a911-1539c53a7a29.exe, PE32 14->61 dropped 113 Adds a directory exclusion to Windows Defender 14->113 24 powershell.exe 14->24         started        26 b2fa1912-a117-45be-a911-1539c53a7a29.exe 14->26         started        signatures6 process7 dnsIp8 77 petknorra.com 95.213.216.169, 49785, 49808, 80 SELECTELRU Russian Federation 19->77 79 106.241.4.103, 49758, 49802, 49866 LGDACOMLGDACOMCorporationKR Korea Republic of 19->79 81 8 other IPs or domains 19->81 47 C:\Users\user\AppData\Roaming\urewbai, PE32 19->47 dropped 49 C:\Users\user\AppData\Local\Temp\A4DF.exe, PE32 19->49 dropped 51 C:\Users\user\AppData\Local\Temp\985.exe, PE32 19->51 dropped 53 5 other files (4 malicious) 19->53 dropped 91 System process connects to network (likely due to code injection or exploit) 19->91 93 Benign windows process drops PE files 19->93 95 Deletes itself after installation 19->95 97 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->97 28 985.exe 4 19->28         started        32 7021.exe 1 19->32         started        35 2328.exe 19->35         started        41 4 other processes 19->41 37 conhost.exe 24->37         started        39 b2fa1912-a117-45be-a911-1539c53a7a29.exe 26->39         started        file9 signatures10 process11 dnsIp12 55 C:\Users\user\AppData\...\SmartClock.exe, PE32 28->55 dropped 115 Detected unpacking (changes PE section rights) 28->115 117 Detected unpacking (overwrites its own PE header) 28->117 119 Machine Learning detection for dropped file 28->119 121 Delayed program exit found 28->121 43 SmartClock.exe 28->43         started        63 91.219.237.226, 49882, 80 SERVERASTRA-ASHU Hungary 32->63 65 t.me 149.154.167.99, 443, 49881 TELEGRAMRU United Kingdom 32->65 69 5 other IPs or domains 32->69 57 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 32->57 dropped 123 Contains functionality to infect the boot sector 35->123 67 185.215.113.29, 1102 WHOLESALECONNECTIONSNL Portugal 41->67 59 C:\Windows\Temp\gsppeho0.inf, Windows 41->59 dropped 125 Adds a directory exclusion to Windows Defender 41->125 45 cmstp.exe 41->45         started        file13 signatures14 process15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31199c08dabb68fd3b693528ba7803890acdea14125bb6bb8b938293da3d4666/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2021-11-19 18:11:44 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gemzycg2xnup2o3jguulu6adrefm32qucjn3no4lsobjhwr5izta._file
Verdict:
malicious
Similar samples:
2895cb29ca63bc4cf8a36af8e029b8bf14be582273d98d203fafaf8f89db27d2
RedLineStealer
305c0c524645f5fdebb135076c3c4411a03102c518385852860ea2120093c5f8
RedLineStealer
5dcbc7f0e894b1830f58e2449e85e4666a303594b18abd1c61e6614218ca5199
RedLineStealer
685737a7f8768d338bfb874c6922f655296d9063a4bd37d326a7da14e4594f4c
RedLineStealer
7163d47439cbab3397556ebda45e83fdea5dd01ce0fcfaae7ad18637a4433455
RedLineStealer
7dab1f684aec2df9de6144f4e14381245275e9d659152d5f40a437f1c1ec3758
RedLineStealer
ac8697711f5fa68084b2c122a9907ab845aff81592d4d1b86bb8d269357b66e2
RedLineStealer
d7cdfb895940efd584c78b7e56f9ed720491234df489ee9eb9aa98c24714d530
RedLineStealer
e4f04712d99435fd9e716a22af790ea6b58547beeb9089c71992e3f3f2ed0c73
RedLineStealer
fe3ae99417e0d632995ad5ceeccc4c0b308b8a30d2c93031f15837b607b8552b
RedLineStealer
+ 2'653 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/211119-wzxb1aecb6/
Behaviour
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Enumerates physical storage devices
Deletes itself
Drops startup file
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
SmokeLoader
Malware Config
C2 Extraction:
http://membro.at/upload/
http://jeevanpunetha.com/upload/
http://misipu.cn/upload/
http://zavodooo.ru/upload/
http://targiko.ru/upload/
http://vues3d.com/upload/
Unpacked files
SH256 hash:
38b50520397a48d6dc0044fb2aca06b6789cfbe921488422471eab7def65e820
MD5 hash:
67c9034e01a3a23f977b8aa138e88b57
SHA1 hash:
e430b48053c15d914edc1eca59be4964292648c2
Link:
https://www.unpac.me/results/2443d576-001a-4905-83cb-1ce4a6dcdfec/
SH256 hash:
31199c08dabb68fd3b693528ba7803890acdea14125bb6bb8b938293da3d4666
MD5 hash:
8386a21536fce0fb742287a2e4aad9fc
SHA1 hash:
ab28a8300bed35ed80a72417fb516dfb4ba38abf
Link:
https://www.unpac.me/results/2443d576-001a-4905-83cb-1ce4a6dcdfec/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/31199c08dabb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/31199c08dabb68fd3b693528ba7803890acdea14125bb6bb8b938293da3d4666

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 31199c08dabb68fd3b693528ba7803890acdea14125bb6bb8b938293da3d4666

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1799142/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/207661/

Comments