MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 437c28024dc2cb9b9e2af98ddd06e4a37ea5b9e24407b868f15c3fd9d600d883. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 437c28024dc2cb9b9e2af98ddd06e4a37ea5b9e24407b868f15c3fd9d600d883
SHA3-384 hash: bb0481cebbc95d711dbdfc40246c2afa0d775d7b66368a94c58438d87b223f4e17ea55bb4a9c3ebdd4d6cabf90d54b1e
SHA1 hash: 5e57fc508a5e5f18b47c518f164601ebec3703d8
MD5 hash: 0b18b37854088186d6a97b49a6f0a77b
humanhash: skylark-helium-beer-single
File name:0b18b37854088186d6a97b49a6f0a77b.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:340'992 bytes
First seen:2021-11-12 11:00:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 89c49e3ae23d79644984deb991645019 (2 x RaccoonStealer, 2 x RedLineStealer, 1 x Glupteba)
ssdeep 6144:aoRs6O26UHqgqiSSMZpAdKUO0r3j07YxPVx6Nxrw:POfsqgqiSSMZpAdKUOGI7YxHSK
Threatray 2'398 similar samples on MalwareBazaar
TLSH T14B748D00BAA0C035F5B352FC5A769379B53F7EE1AB6490CB12D52AEA56746E0ED30307
File icon (PE):PE icon
dhash icon e0e8e8e8aa66a489 (8 x RaccoonStealer, 6 x RedLineStealer, 2 x Tofsee)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
212.86.102.63:62907

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
212.86.102.63:62907 https://threatfox.abuse.ch/ioc/246887/

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/205265/
Detection(s):
Win.Malware.Generic-9908111-0
Create hunting rule

Win.Dropper.Ulise-9908333-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/618e4972a00afa9663a4fdc7/reports/9b13a836-94ae-4c60-8cb1-373e5717a027/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a76730fa-2d18-4921-ad76-d8dd3b3d55f2
Result
Threat name:
Clipboard Hijacker RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/888057
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Delayed program exit found
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Clipboard Hijacker
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 520527 Sample: pUXPTJky0R.exe Startdate: 12/11/2021 Architecture: WINDOWS Score: 100 53 Multi AV Scanner detection for domain / URL 2->53 55 Found malware configuration 2->55 57 Antivirus detection for URL or domain 2->57 59 12 other signatures 2->59 8 pUXPTJky0R.exe 2->8         started        11 hefeecv 2->11         started        13 hefeecv 2->13         started        15 SmartClock.exe 2->15         started        process3 signatures4 81 Detected unpacking (changes PE section rights) 8->81 83 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 8->83 85 Maps a DLL or memory area into another process 8->85 17 explorer.exe 6 8->17 injected 87 Multi AV Scanner detection for dropped file 11->87 89 Machine Learning detection for dropped file 11->89 91 Checks if the current machine is a virtual machine (disk enumeration) 11->91 93 Creates a thread in another existing process (thread injection) 13->93 process5 dnsIp6 45 nutriescapa.com 195.133.74.88, 49793, 49801, 80 MTW-ASRU Russian Federation 17->45 47 misha.at 186.74.208.84, 49780, 49786, 49791 CableWirelessPanamaPA Panama 17->47 49 8 other IPs or domains 17->49 35 C:\Users\user\AppData\Roaming\hefeecv, PE32 17->35 dropped 37 C:\Users\user\AppData\Local\Temp\882.exe, PE32 17->37 dropped 39 C:\Users\user\AppData\Local\Temp\4995.exe, PE32 17->39 dropped 41 2 other malicious files 17->41 dropped 61 System process connects to network (likely due to code injection or exploit) 17->61 63 Benign windows process drops PE files 17->63 65 Deletes itself after installation 17->65 67 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->67 22 4995.exe 5 17->22         started        26 882.exe 4 17->26         started        29 331E.exe 17->29         started        31 SmartClock.exe 17->31         started        file7 signatures8 process9 dnsIp10 51 185.215.113.29, 1102, 49859 WHOLESALECONNECTIONSNL Portugal 22->51 69 Detected unpacking (overwrites its own PE header) 22->69 71 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 22->71 73 Machine Learning detection for dropped file 22->73 79 2 other signatures 22->79 43 C:\Users\user\AppData\...\SmartClock.exe, PE32 26->43 dropped 75 Detected unpacking (changes PE section rights) 26->75 77 Delayed program exit found 26->77 33 SmartClock.exe 26->33         started        file11 signatures12 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/437c28024dc2cb9b9e2af98ddd06e4a37ea5b9e24407b868f15c3fd9d600d883/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2021-11-11 22:38:38 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=in6cqasnylfzxhrk7gg52bxeun7klopciqd3q2hrlq75tvqa3cbq._file
Verdict:
malicious
Similar samples:
0a223aa68af0c2af0baabda61d82748629078720a017ef4836f3322a76cb691a
RedLineStealer
22b13294437f3dc3266f4517bf126e7f3b84d96c05f299f41a59887f7710338c
RedLineStealer
62f94256e7fc124c7292edefd8b589dad48601ff53d4058848b91a788a981e14
RedLineStealer
672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8
RedLineStealer
6f279d711337e4691a39d38937f64047e8d07215f4216f195517772ff6a4706f
RedLineStealer
8577213832eecf00f77003ddf49fb6630af4906b10b350f9dd88a899d9720a98
RedLineStealer
8999c280aca7419a8b6fe0be172723fb66f18fc1439fb2ffa463d9315b79535d
RedLineStealer
a30a63ed80fbb773fef1d1e92d3d51a049e1b3ef79036ab064efa6d98502b824
RedLineStealer
d3184ceae376a789ccd61e767da3f21cacd72dfc7162a5e1a9569c7244d0bf9a
RedLineStealer
+ 2'388 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor persistence suricata trojan upx
Link:
https://tria.ge/reports/211112-m4jr2aacdk/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies registry key
Runs net.exe
Script User-Agent
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: LoadsDriver
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Deletes itself
Drops startup file
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Modifies RDP port number used by Windows
Sets DLL path for service in the registry
UPX packed file
Grants admin privileges
SmokeLoader
suricata: ET MALWARE ServHelper CnC Inital Checkin
Malware Config
C2 Extraction:
http://misha.at/upload/
http://roohaniinfra.com/upload/
http://0axqpcc.cn/upload/
http://mayak-lombard.ru/upload/
http://mebel-lass.ru/upload/
http://dishakhan.com/upload/
Dropper Extraction:
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Unpacked files
SH256 hash:
2d42354cb59833a247375928187032beead3c641520e36824fce6f48b126d8a6
MD5 hash:
38fa5abed729083474ad8e1084b03b6d
SHA1 hash:
707a3feb91f1242f57bdd9fb6b3852462b64a985
Link:
https://www.unpac.me/results/d2ff64c9-20c1-4169-8883-d6d4bbba2690/
SH256 hash:
437c28024dc2cb9b9e2af98ddd06e4a37ea5b9e24407b868f15c3fd9d600d883
MD5 hash:
0b18b37854088186d6a97b49a6f0a77b
SHA1 hash:
5e57fc508a5e5f18b47c518f164601ebec3703d8
Link:
https://www.unpac.me/results/d2ff64c9-20c1-4169-8883-d6d4bbba2690/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/437c28024dc2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/437c28024dc2cb9b9e2af98ddd06e4a37ea5b9e24407b868f15c3fd9d600d883

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 437c28024dc2cb9b9e2af98ddd06e4a37ea5b9e24407b868f15c3fd9d600d883

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1766412/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/205265/

Comments