MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c579294e0dbba06e014a4223674c170d35e59bc164f02df428d43ca8e9af974. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs 1 YARA File information Comments

SHA256 hash:	4c579294e0dbba06e014a4223674c170d35e59bc164f02df428d43ca8e9af974
SHA3-384 hash:	cb7d9e8403578931b284827e657761ad2739ccf7d6c6361523c02778f6a378d181855ed293f10fc88fd60b4dc081ad9f
SHA1 hash:	b01b012e0e3f64f02582f03c90e18533b95a0e4d
MD5 hash:	4cf695774c26660840421948fcbf84fa
humanhash:	nevada-maine-vermont-three
File name:	4cf695774c26660840421948fcbf84fa.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	163'328 bytes
First seen:	2021-11-19 15:36:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d447c88e5ba79016e49c5de135738a35 (5 x Smoke Loader, 3 x ArkeiStealer, 2 x RedLineStealer)
ssdeep	3072:s7Y4z1YII+Q9NTHPIfW/lGB3g2Hese6xEks:CWII+Q9N7PyW/A3gsdNyk
Threatray	2'662 similar samples on MalwareBazaar
TLSH	T144F39D2432E1C833E3E72530653CD6A15A7A78722677858F3758262EBE702D04ABD777
File icon (PE):
dhash icon	fcfcf4d4d4d4d8c0 (41 x RedLineStealer, 30 x RaccoonStealer, 9 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
146.185.239.5:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
146.185.239.5:80	https://threatfox.abuse.ch/ioc/251032/

Intelligence

File Origin

# of uploads :

# of downloads :

174

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

4cf695774c26660840421948fcbf84fa.exe

Verdict:

No threats detected

Analysis date:

2021-11-19 15:40:30 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e02ce205-f501-4f5e-9196-a436f372e698

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

DNS request

Sending a custom TCP request

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Sending an HTTP POST request

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6197c4a12695a62af9f3ea15/reports/b5d17bc4-cdb3-4b1b-982e-f33465c54627/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c743e0d8-7b57-4e7f-b221-2e54e8071496

Result

Threat name:

Clipboard Hijacker Raccoon RedLine Smoke

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/892763

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to infect the boot sector

Creates a thread in another existing process (thread injection)

Delayed program exit found

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

System process connects to network (likely due to code injection or exploit)

Yara detected Clipboard Hijacker

Yara detected Raccoon Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4c579294e0dbba06e014a4223674c170d35e59bc164f02df428d43ca8e9af974/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2021-11-19 15:37:05 UTC

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jrlzffha3o5anyauuqrdm5gbodjv4wn4czhqfx2crvb4vdu27f2a._file

Verdict:

malicious

RedLineStealer

305c0c524645f5fdebb135076c3c4411a03102c518385852860ea2120093c5f8

RedLineStealer

5dcbc7f0e894b1830f58e2449e85e4666a303594b18abd1c61e6614218ca5199

RedLineStealer

685737a7f8768d338bfb874c6922f655296d9063a4bd37d326a7da14e4594f4c

RedLineStealer

7163d47439cbab3397556ebda45e83fdea5dd01ce0fcfaae7ad18637a4433455

RedLineStealer

7dab1f684aec2df9de6144f4e14381245275e9d659152d5f40a437f1c1ec3758

RedLineStealer

ac8697711f5fa68084b2c122a9907ab845aff81592d4d1b86bb8d269357b66e2

RedLineStealer

d7cdfb895940efd584c78b7e56f9ed720491234df489ee9eb9aa98c24714d530

RedLineStealer

e4f04712d99435fd9e716a22af790ea6b58547beeb9089c71992e3f3f2ed0c73

RedLineStealer

fe3ae99417e0d632995ad5ceeccc4c0b308b8a30d2c93031f15837b607b8552b

RedLineStealer

+ 2'652 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/211119-s2f61sdfh8/

Behaviour

Checks SCSI registry key(s)

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Deletes itself

Drops startup file

Loads dropped DLL

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://membro.at/upload/
http://jeevanpunetha.com/upload/
http://misipu.cn/upload/
http://zavodooo.ru/upload/
http://targiko.ru/upload/
http://vues3d.com/upload/