MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38920e6f3a9c5908e9360388f0aa1f65b8e3df46849d758db7e1cdbf84727e3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TaurusStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38920e6f3a9c5908e9360388f0aa1f65b8e3df46849d758db7e1cdbf84727e3f
SHA3-384 hash: d2e8e1d449e064165162849b18c4308d51bc7b7273c86e7010c45aada8e2f0a6c7dfbf0e153c711f82a3f1d3e953d13b
SHA1 hash: e57b794220e7a6184614ccd4a6ddcf99de7e0717
MD5 hash: f5366963764901262499c8021333f986
humanhash: eighteen-lactose-cat-moon
File name:f5366963764901262499c8021333f986.exe
Download: download sample
Signature TaurusStealer
Create hunting rule
File size:1'114'731 bytes
First seen:2021-03-21 07:22:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e9c0657252137ac61c1eeeba4c021000 (53 x GuLoader, 26 x RedLineStealer, 17 x AgentTesla)
ssdeep 24576:tA5faXJsHgzLpuwZYvcVlKs+woc5hQ171bei+hU+AEOq:y5faZsHgzlDZYAj+WvQR1WU+FOq
Threatray 184 similar samples on MalwareBazaar
TLSH 3635238638E5FA39DB643D374D6AD36A5B3A9D148BC05B022F00753BBAF25412F1E718
Reporter abuse_ch
Tags:exe TaurusStealer


Avatar
abuse_ch
TaurusStealer C2:
http://80.78.245.80/cfg/
http://80.78.245.80/dlls/
http://80.78.245.80/log/

Intelligence

File Origin
# of uploads :
1
# of downloads :
272
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f5366963764901262499c8021333f986.exe
Verdict:
Malicious activity
Analysis date:
2021-03-21 07:23:12 UTC
Tags:
trojan taurus stealer predator rat redline
Link:
https://app.any.run/tasks/9e51f345-89b3-42a9-afc9-99daf88cb451

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Packed.Dopping-9832657-0
Create hunting rule

SecuriteInfo.com.MSIL.Kryptik.UGA.20041.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Launching a process
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Containing strings that indicate a threat
Sending an HTTP POST request
Deleting a recently created file
Reading critical registry keys
Replacing files
Connection attempt
Unauthorized injection to a recently created process
Stealing user critical data
Unauthorized injection to a recently created process by context flags manipulation
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TaurusStealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4a3ef310-0691-446d-82d6-521db51092f2
Result
Threat name:
Predator RedLine Taurus Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/647017
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Uses known network protocols on non-standard ports
Yara detected AntiVM3
Yara detected Predator
Yara detected RedLine Stealer
Yara detected Taurus Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 372477 Sample: 5MZKivSsq7.exe Startdate: 21/03/2021 Architecture: WINDOWS Score: 100 56 Found malware configuration 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 Yara detected Taurus Stealer 2->60 62 8 other signatures 2->62 8 5MZKivSsq7.exe 20 2->8         started        process3 file4 36 C:\Users\user\AppData\Local\Temp\riv.exe, PE32 8->36 dropped 38 C:\Users\user\AppData\Local\Temp\jayson.exe, PE32 8->38 dropped 40 C:\Users\user\AppData\Local\...\YPUD2.dll, PE32 8->40 dropped 42 2 other files (none is malicious) 8->42 dropped 11 cmd.exe 1 8->11         started        process5 process6 13 jayson.exe 3 11->13         started        17 riv.exe 13 11->17         started        20 powershell.exe 15 14 11->20         started        22 3 other processes 11->22 dnsIp7 44 C:\Users\user\AppData\...\jayson.exe.log, ASCII 13->44 dropped 66 Multi AV Scanner detection for dropped file 13->66 68 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->68 70 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 13->70 72 Injects a PE file into a foreign processes 13->72 24 jayson.exe 14 22 13->24         started        28 jayson.exe 13->28         started        46 80.78.245.80, 49712, 80 AGAVA3RU Russian Federation 17->46 74 Detected unpacking (changes PE section rights) 17->74 76 Detected unpacking (overwrites its own PE header) 17->76 78 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->78 82 2 other signatures 17->82 30 WerFault.exe 17->30         started        48 iplogger.org 88.99.66.31, 443, 49725 HETZNER-ASDE Germany 20->48 80 May check the online IP address of the machine 20->80 32 conhost.exe 22->32         started        34 conhost.exe 22->34         started        file8 signatures9 process10 dnsIp11 50 api.ip.sb 24->50 52 87.251.71.75, 3214, 49727, 49748 RMINJINERINGRU Russian Federation 24->52 54 3 other IPs or domains 24->54 64 Tries to harvest and steal browser information (history, passwords, etc) 24->64 signatures12
Detection:
redlinestealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/38920e6f3a9c5908e9360388f0aa1f65b8e3df46849d758db7e1cdbf84727e3f/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-21 05:44:21 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hcja43z2trmqr2jwaoepbkq7mw4ohx2gqsoxldnx4hg37bdspy7q._file
Verdict:
malicious
Similar samples:
06464b0e584f2b64445ef449924c57a5b8d7472056af2eb53f5f6d8d56cce81a
TaurusStealer
267adb8b92c06ae53186fc26b40caf4d9e1ae4893475b2d1d8f29b040c67d9b4
TaurusStealer
593f9422a79559ab792b98a272ebd5db883b8a85f34de6a6f05f1c900b221dc5
TaurusStealer
715a7e61152baeb46f1197fb49194205b2816902a1f630845f089f5ef57108fd
TaurusStealer
7f2da313a75add2d2762a6f8ef8ca2828fb96661ab726b8aaad79ae5f89577c9
TaurusStealer
887084bcfd243d9c685a80c8b94ff04b56936b6a282988a2488463ba70e7d054
TaurusStealer
ae2ff54d0460f10178a7984924504119353fe27dd7c84f1166505593cb7e464b
TaurusStealer
b0237d56d9d18a2211cc5cda22534f4b20fece44178bc9cbd8b5d2f469916f44
TaurusStealer
e8234089e3729bbb6cbf5cf5deddad37b3dbe90180bc307ac8105f5f240a5b82
TaurusStealer
f5a0900115503296a1c649fc91fe8fc1458e1fd4dbd36dab87f4ae468c679c08
TaurusStealer
+ 174 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210321-zet2e1kg8n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Executes dropped EXE
RedLine
RedLine Payload
Unpacked files
SH256 hash:
f11228a6b253ae69538863f0bd6e909bc3bae83b724cdb975b0232387577d438
MD5 hash:
076b69f58b1df414b7ce78de7a1e958d
SHA1 hash:
589c9ce67d59142333f2b9a2e138ac05befa145a
Link:
https://www.unpac.me/results/167b7cd8-d4b1-4d41-9661-fdd8e7e65e82/
SH256 hash:
b169ab1b6ece4fe9b848c37f64143d9976bf248a7a44ec63b95d066ba71a0a05
MD5 hash:
05c9bb6ea95123703c8139a7941ba52d
SHA1 hash:
dc79527c6e75cb0781d8bfc59eaafdbb3288c556
Link:
https://www.unpac.me/results/167b7cd8-d4b1-4d41-9661-fdd8e7e65e82/
SH256 hash:
9ed6d904fc932759558821fe479d0ad3abf08ffbc24afb7936435fc6cf7d40a7
MD5 hash:
996922f28f7a6b3f5868e189cc960fc6
SHA1 hash:
5d8b559dafc07e9c60d446499eb49e9ad0cc6bd9
Link:
https://www.unpac.me/results/167b7cd8-d4b1-4d41-9661-fdd8e7e65e82/
SH256 hash:
fdccaed76f7279e6b8cc1579dadeed03fa1b8d1adcdfbcac585a68da168366d5
MD5 hash:
8b603b23caf00139206f293eb741a9f0
SHA1 hash:
1cc90aec7ce07b13930fe0c088fe3cd155b3ea07
Link:
https://www.unpac.me/results/167b7cd8-d4b1-4d41-9661-fdd8e7e65e82/
SH256 hash:
49b7477db8dd22f8cf2d41ee2d79ce57797f02e8c7b9e799951a6c710384349a
MD5 hash:
293165db1e46070410b4209519e67494
SHA1 hash:
777b96a4f74b6c34d43a4e7c7e656757d1c97f01
Link:
https://www.unpac.me/results/167b7cd8-d4b1-4d41-9661-fdd8e7e65e82/
SH256 hash:
8c02707567ed32190b4810a573a6d9969fe679116f8aa7bbebd556da2eef8e4a
MD5 hash:
bd6dd1ee663e4d8d0ce18b53d0a1f25a
SHA1 hash:
0dd934567aba02105ecc67d79513a574feac1468
Link:
https://www.unpac.me/results/167b7cd8-d4b1-4d41-9661-fdd8e7e65e82/
SH256 hash:
10dc013ad985e0ddaed32630c83e57ef95e5c4fadb178e55b4b9b4885250e9a7
MD5 hash:
bdac42d9aeed5d9e4a5724c200af43aa
SHA1 hash:
3b08e68fd7e49d0295b19df2e3a2e844e0fba4ad
Link:
https://www.unpac.me/results/167b7cd8-d4b1-4d41-9661-fdd8e7e65e82/
SH256 hash:
a6fe62d19b2b0f608fe3367ba5612742b9ff248b91a32b13fe189c891a22a00d
MD5 hash:
729168d16501390f6b7d92edb38886c4
SHA1 hash:
d244dc2a6325b22a02372c2b8e01ef4a3e51d10c
Link:
https://www.unpac.me/results/167b7cd8-d4b1-4d41-9661-fdd8e7e65e82/
SH256 hash:
38920e6f3a9c5908e9360388f0aa1f65b8e3df46849d758db7e1cdbf84727e3f
MD5 hash:
f5366963764901262499c8021333f986
SHA1 hash:
e57b794220e7a6184614ccd4a6ddcf99de7e0717
Link:
https://www.unpac.me/results/167b7cd8-d4b1-4d41-9661-fdd8e7e65e82/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/38920e6f3a9c5908e9360388f0aa1f65b8e3df46849d758db7e1cdbf84727e3f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:Telegram_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TaurusStealer

Executable exe 38920e6f3a9c5908e9360388f0aa1f65b8e3df46849d758db7e1cdbf84727e3f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1011491/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1011490/
  
URLhaus
https://urlhaus.abuse.ch/url/1083193/

Comments