MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b7afd2aace35ca6a51322aaa40ceedafaead4759fb30c2f2250266105ef5faf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b7afd2aace35ca6a51322aaa40ceedafaead4759fb30c2f2250266105ef5faf
SHA3-384 hash: ae3e79c75c39d5821f87967d09881cf79dbba1e758323ce1a1a8e6062677c48b2ff4a5e1b2e9c9728b6dab330a3ec0f0
SHA1 hash: 59ed201dcd00b701951e742c2cb8c9cc4c830996
MD5 hash: ff4ce3df606c536efb0b6bb7cbc8749f
humanhash: cat-ohio-sad-dakota
File name:ff4ce3df606c536efb0b6bb7cbc8749f.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:344'064 bytes
First seen:2022-02-27 13:40:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5fff1449f6cb3dd03e641f1c2c37ccb5 (1 x RaccoonStealer, 1 x RedLineStealer)
ssdeep 6144:BZbp5uNY9frMUMYd0U2MwzmdrsRec5OmZ4lHn3:Dfum9fYtYd0U2MFhp
Threatray 4'143 similar samples on MalwareBazaar
TLSH T160749E40ABA0C03DE0B711F87975D3ADA52E7DF19B2851CB62D12AEE56346E0DC7530B
File icon (PE):PE icon
dhash icon 25ec137031939b91 (2 x RedLineStealer, 2 x CoinMiner, 2 x Stop)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
91.243.59.196:32798

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
91.243.59.196:32798 https://threatfox.abuse.ch/ioc/391136/

Intelligence

File Origin
# of uploads :
1
# of downloads :
322
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/245089/
Detection(s):
Win.Packed.Filerepmalware-9939423-0
Create hunting rule

Win.Dropper.Generickdz-9939781-0
Create hunting rule

Win.Dropper.Generickdz-9939782-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/7528/overview
Behaviour
MalwareBazaar
SystemUptime
CPUID_Instruction
MeasuringTime
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
glupteba greyware mikey mokes packed
Link:
https://www.filescan.io/uploads/621b7f73dfdfa8501c65ecc7/reports/01187f10-a274-4ece-88b2-a41e3fa806be/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0cbe9b0e-8606-4bf7-a521-f69ccf57e296
Result
Threat name:
DanaBot SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/946940
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected DanaBot stealer dll
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 579421 Sample: ZjUrFikX7P.exe Startdate: 27/02/2022 Architecture: WINDOWS Score: 100 60 store-images.s-microsoft.com 2->60 70 Found malware configuration 2->70 72 Antivirus detection for URL or domain 2->72 74 Multi AV Scanner detection for submitted file 2->74 76 5 other signatures 2->76 9 ZjUrFikX7P.exe 2->9         started        12 rrewvev 2->12         started        14 gvewvev 2->14         started        signatures3 process4 signatures5 88 Detected unpacking (changes PE section rights) 9->88 90 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 9->90 92 Maps a DLL or memory area into another process 9->92 16 explorer.exe 8 9->16 injected 94 Multi AV Scanner detection for dropped file 12->94 96 Machine Learning detection for dropped file 12->96 98 Checks if the current machine is a virtual machine (disk enumeration) 12->98 100 Creates a thread in another existing process (thread injection) 14->100 process6 dnsIp7 54 dollybuster.at 37.75.37.31, 49753, 49756, 49762 VFM-ASVodafoneMaltaLtdASMT Malta 16->54 56 oakland-studio.video 143.198.125.86, 443, 49829, 49830 LDCOMNETFR United States 16->56 58 8 other IPs or domains 16->58 46 C:\Users\user\AppData\Roaming\rrewvev, PE32 16->46 dropped 48 C:\Users\user\AppData\Roaming\gvewvev, PE32 16->48 dropped 50 C:\Users\user\AppData\Local\Temp\AB6C.exe, PE32 16->50 dropped 52 3 other malicious files 16->52 dropped 62 System process connects to network (likely due to code injection or exploit) 16->62 64 Benign windows process drops PE files 16->64 66 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 16->66 68 4 other signatures 16->68 21 AB6C.exe 16->21         started        24 3EC0.exe 16->24         started        26 5660.exe 16->26         started        28 cmd.exe 1 16->28         started        file8 signatures9 process10 signatures11 78 Detected unpacking (changes PE section rights) 21->78 80 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 21->80 82 Maps a DLL or memory area into another process 21->82 86 2 other signatures 21->86 84 Machine Learning detection for dropped file 24->84 30 WerFault.exe 3 10 24->30         started        32 WerFault.exe 10 24->32         started        34 WerFault.exe 10 26->34         started        36 WerFault.exe 10 26->36         started        38 WMIC.exe 1 28->38         started        40 WMIC.exe 1 28->40         started        42 WMIC.exe 1 28->42         started        44 2 other processes 28->44 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b7afd2aace35ca6a51322aaa40ceedafaead4759fb30c2f2250266105ef5faf/
Threat name:
Win32.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2022-02-19 13:43:57 UTC
File Type:
PE (Exe)
Extracted files:
46
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hn5p2kvm4noknjitekvkidho3l5ovvdvt6zqylzckatgcbppl6xq._file
Verdict:
malicious
Similar samples:
1136cc54d8c5c563ebc7f940ed46f4ed6e95057278a94923dc0fd1f80000d7b0
RedLineStealer
2065e97e2c2670b6e40a74285e8302580b7f1026b57a3e666b5680737389f2dc
RedLineStealer
55560b608e7a7515329d395c72dc9cebc5cdd7b4c0f153d6e02eb74c2a609feb
RedLineStealer
672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8
RedLineStealer
6f279d711337e4691a39d38937f64047e8d07215f4216f195517772ff6a4706f
RedLineStealer
d3184ceae376a789ccd61e767da3f21cacd72dfc7162a5e1a9569c7244d0bf9a
RedLineStealer
e0a33241f5c4ac8f304af0387ddc54da264c0a5101c822d0fc71b10af947b391
RedLineStealer
e7a7032ddae1adfd64c4c378c6e97be7a2453228c7014a21d3945fc3ddc85d75
RedLineStealer
+ 4'133 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor suricata trojan
Link:
https://tria.ge/reports/220227-qy4f2adegp/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Deletes itself
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
SmokeLoader
suricata: ET MALWARE Danabot Key Exchange Request
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Malware Config
C2 Extraction:
http://dollybuster.at/upload/
http://spaldingcompanies.com/upload/
http://remik-franchise.ru/upload/
http://fennsports.com/upload/
http://am1420wbec.com/upload/
http://islamic-city.com/upload/
http://egsagl.com/upload/
http://mordo.ru/upload/
http://piratia-life.ru/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Unpacked files
SH256 hash:
6f00a8bf3263bb777dbfe93319ac23ad52a56900ac6a6cfe2605baa7fdf2291a
MD5 hash:
c6797f560af2dd1c44500bfca4d18fcb
SHA1 hash:
ba29c9a96f289255c9c8bef1fcabcf4ab094aa21
Link:
https://www.unpac.me/results/6ab9c654-cc33-4749-8c7a-c9856ad9df35/
SH256 hash:
3b7afd2aace35ca6a51322aaa40ceedafaead4759fb30c2f2250266105ef5faf
MD5 hash:
ff4ce3df606c536efb0b6bb7cbc8749f
SHA1 hash:
59ed201dcd00b701951e742c2cb8c9cc4c830996
Link:
https://www.unpac.me/results/6ab9c654-cc33-4749-8c7a-c9856ad9df35/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3b7afd2aace35ca6a51322aaa40ceedafaead4759fb30c2f2250266105ef5faf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/245089/

Comments