MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 45aa4cd8895cde34a9e5088e968f73a2776e28a404cea75b639fe875cb66dcf9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 17
| SHA256 hash: | 45aa4cd8895cde34a9e5088e968f73a2776e28a404cea75b639fe875cb66dcf9 |
|---|---|
| SHA3-384 hash: | 53c421e7a73f6de732b7fb8d309d1935efc0428a2b34ec7e83b83cb822cad1f6ebd10a8662c28e8614283952a36693ea |
| SHA1 hash: | b23dc210c54f0cd420a91e862807e5936ce305bd |
| MD5 hash: | 0789c008b2eaf3b8dcaafe7ecdea4a12 |
| humanhash: | fillet-alanine-oklahoma-utah |
| File name: | 0789c008b2eaf3b8dcaafe7ecdea4a12.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 388'608 bytes |
| First seen: | 2023-10-22 02:35:16 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader) |
| ssdeep | 6144:K5y+bnr+wp0yN90QEQdNl4whvAUrigxrvCbw2OMihB1+Q4BlR6Jkz6KVr:fMrMy90qlBhvA3urab3TDR6J4r |
| Threatray | 2'166 similar samples on MalwareBazaar |
| TLSH | T125840263FAE95077D8B5177018F703C31A32FCA18938935B3795A99E0C72A94A53137B |
| TrID | 70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 3.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) |
| File icon (PE): |  |
| dhash icon | f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader) |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
297
Origin country :
NLVendor Threat Intelligence
Malware family:
smoke
ID:
1
File name:
0789c008b2eaf3b8dcaafe7ecdea4a12.exe
Verdict:
Malicious activity
Analysis date:
2023-10-22 02:37:31 UTC
Tags:
stealc stealer loader smoke
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Launching a service
Sending a custom TCP request
Creating a file
Сreating synchronization primitives
Unauthorized injection to a recently created process
Blocking the Windows Defender launch
Disabling the operating system update service
Unauthorized injection to a system process
Sending an HTTP POST request to an infection source
Gathering data
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
advpack anti-vm CAB control explorer installer lolbin mokes packed rundll32 setupapi sfx shell32 smokeloader xpack
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Healer AVKiller
Verdict:
Malicious
Result
Threat name:
Mystic Stealer, SmokeLoader
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Yara detected Mystic Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Detection:
smokeloader
Threat name:
Win32.Trojan.Smokeloader
Status:
Malicious
First seen:
2023-10-18 19:57:48 UTC
File Type:
PE (Exe)
Extracted files:
76
AV detection:
20 of 37 (54.05%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 2'156 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Score:
10/10
Tags:
family:amadey family:asyncrat family:dcrat family:glupteba family:redline family:sectoprat family:smokeloader botnet:5141679758_99 botnet:default botnet:kolyan botnet:pixelscloud2.0 botnet:supera botnet:up3 botnet:yt&team cloud backdoor discovery dropper evasion infostealer loader persistence rat spyware trojan
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Enumerates system info in registry
Modifies Internet Explorer settings
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Program crash
Launches sc.exe
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Windows security modification
Downloads MZ/PE file
Modifies Windows Firewall
Stops running service(s)
Async RAT payload
Amadey
AsyncRat
DcRat
Glupteba
Glupteba payload
Modifies Windows Defender Real-time Protection settings
RedLine
RedLine payload
SectopRAT
SectopRAT payload
SmokeLoader
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
http://77.91.68.29/fks/
77.91.124.82:19071
http://77.91.124.1/theme/index.php
85.209.176.128:80
https://pastebin.com/raw/8baCJyMF
185.216.70.238:37515
http://host-file-host6.com/
http://host-host-file8.com/
89.23.100.93:4449
77.91.124.82:19071
http://77.91.124.1/theme/index.php
85.209.176.128:80
https://pastebin.com/raw/8baCJyMF
185.216.70.238:37515
http://host-file-host6.com/
http://host-host-file8.com/
89.23.100.93:4449
Unpacked files
SH256 hash:
a63682cddfeb906d3906209a0d7ccfba932ddf5cf83c2cc5f424ea3cc71e7a5b
MD5 hash:
8b8c33bf4d8712e251e8de36031fe6d6
SHA1 hash:
aa24eacc9268e0aad42aa0562fcfedef4844fbb2
SH256 hash:
f023d33fbddc121859881a6d95518189b9aa8acac0a268a60ba9ad237c50c497
MD5 hash:
1dfb9e41294bdceb01be880236102ab0
SHA1 hash:
3f33e263463cf1ca21135b6339862246fcad8667
SH256 hash:
3e062b694afdddafa5a183b353e4c2d43600563ef962d0284c5258bef7376b95
MD5 hash:
0208754263bfd5dba76f14303d547479
SHA1 hash:
97b1c96e68f363b34f0d140cc50c1e1c710e4b55
Detections:
win_smokeloader_a2
Parent samples :
282dc6e812260cc03b799309dae8fc341d2fbdc635e67aaadb3f5b3e045865db
e9d6ddaf1fb2b2ccffc9da08350fe052821b36211b8822b0e7c413638c1cbbbe
815ba7f94597b7f2c838c7244b2a0494902ee4cc073f375ca4eb3abdc8ed0b3a
47450287dbb0833027118daa007d1e6fedbd1778480a3089e141692d7d6f8707
b8bf36d283278b94e53ba6b660dee1debbcf9f5628ee5b5ab46f789a414b6863
e45b3ee9e98fbf06f2738e3a0d4b584079907274dec7df8b5062799da8487546
45aa4cd8895cde34a9e5088e968f73a2776e28a404cea75b639fe875cb66dcf9
e9d6ddaf1fb2b2ccffc9da08350fe052821b36211b8822b0e7c413638c1cbbbe
815ba7f94597b7f2c838c7244b2a0494902ee4cc073f375ca4eb3abdc8ed0b3a
47450287dbb0833027118daa007d1e6fedbd1778480a3089e141692d7d6f8707
b8bf36d283278b94e53ba6b660dee1debbcf9f5628ee5b5ab46f789a414b6863
e45b3ee9e98fbf06f2738e3a0d4b584079907274dec7df8b5062799da8487546
45aa4cd8895cde34a9e5088e968f73a2776e28a404cea75b639fe875cb66dcf9
SH256 hash:
45aa4cd8895cde34a9e5088e968f73a2776e28a404cea75b639fe875cb66dcf9
MD5 hash:
0789c008b2eaf3b8dcaafe7ecdea4a12
SHA1 hash:
b23dc210c54f0cd420a91e862807e5936ce305bd
Malware family:
SmokeLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | detect_Redline_Stealer |
|---|---|
| Author: | Varp0s |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.