MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d49d50b59d87b380045384e5b23ddcd57ee91c3cc52c63457fe94554f67cd3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4d49d50b59d87b380045384e5b23ddcd57ee91c3cc52c63457fe94554f67cd3a
SHA3-384 hash:	d3f8faa51cfb3a9b4625b12200089e38dd03a1c5904359267c44167f717c98a7fc62ab2f4b9bab4835ee22e2fe13d488
SHA1 hash:	5148317b1070e76b0dd9378a7bfdecccc73a0222
MD5 hash:	cd4535bcc370daafcea1feaf3e8704ca
humanhash:	blue-hawaii-may-quiet
File name:	cd4535bcc370daafcea1feaf3e8704ca.exe
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	2'605'056 bytes
First seen:	2023-12-28 23:25:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep	49152:A+QInJbeYnVWRf2RbXFXapGdbMiGJJcnmgdvLZz9bJ8BDT4QdqU5XTXf8:RQbYKfiVX2Gdgzzc3JYHqU5XTP8
TLSH	T105C533A3A1E40276D8B9977114F71AC72335BEA19C74224F13205ADE1CF75E22D1FB2A
TrID	41.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 22.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 11.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 7.5% (.EXE) Win64 Executable (generic) (10523/12/4) 4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):
dhash icon	f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
195.20.16.103:20440

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

532

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28840.BadO.UNOFFICIAL

Alert

Create hunting rule

Win.Packed.Stealerc-10017072-0

Alert

Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Creating a window

Launching a process

Сreating synchronization primitives

Searching for the browser window

Searching for the window

DNS request

Sending a custom TCP request

Reading critical registry keys

Blocking the Windows Defender launch

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

advpack anti-vm CAB control explorer installer installer lolbin packed rundll32 setupapi sfx shell32

Link:

https://www.filescan.io/uploads/658e040a6b1c2460460d8d94/reports/2d06c882-f877-48a4-b502-2dfe97e859fe/overview

Hybrid Analysis Win/malicious_confidence_90%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/4d49d50b59d87b380045384e5b23ddcd57ee91c3cc52c63457fe94554f67cd3a

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bec46af0-e95d-4174-9e3c-3c3e02eb356f

Joe Sandbox RisePro Stealer, SmokeLoader

Result

Threat name:

RisePro Stealer, SmokeLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1367883

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Binary is likely a compiled AutoIt script file

Contains functionality to modify clipboard data

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies Windows Defender protection settings

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

PE file has nameless sections

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Suspicious execution chain found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected RisePro Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/4d49d50b59d87b380045384e5b23ddcd57ee91c3cc52c63457fe94554f67cd3a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4d49d50b59d87b380045384e5b23ddcd57ee91c3cc52c63457fe94554f67cd3a/

ReversingLabs TitaniumCloud Win32.Trojan.GenSHCode

Threat name:

Win32.Trojan.GenSHCode

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-28 23:26:10 UTC

File Type:

PE (Exe)

Extracted files:

202

AV detection:

14 of 19 (73.68%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jve5kc2z3b5tqacfhbhfwi65zvl65eodzrjmmncx72kfkt3hzu5a._file

Threatray malicious

Verdict:

malicious

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

brand:google collection discovery evasion persistence phishing spyware stealer trojan

Link:

https://tria.ge/reports/231228-3ethyabcgl/

Behaviour

Creates scheduled task(s)

Modifies Internet Explorer settings

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Program crash

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

Drops startup file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Detected google phishing page

Modifies Windows Defender Real-time Protection settings

UnpacMe AutoIT_Compiled

Unpacked files

SH256 hash:

8266f990281f6812011265d2bf09b428a7fe4b8da8666c5560899bbc13d0ee84

MD5 hash:

cc62dfee3e5f3bc4ab227eeef8ee20da

SHA1 hash:

69ac7bf0a0554b9e06bc8d568ea1f6312103c04c

Detections:

AutoIT_Compiled

Alert

Create hunting rule

Link:

https://www.unpac.me/results/6439ba9a-2485-45bb-8036-ff7be12a9d4e/

SH256 hash:

4d49d50b59d87b380045384e5b23ddcd57ee91c3cc52c63457fe94554f67cd3a

MD5 hash:

cd4535bcc370daafcea1feaf3e8704ca

SHA1 hash:

5148317b1070e76b0dd9378a7bfdecccc73a0222

Link:

https://www.unpac.me/results/6439ba9a-2485-45bb-8036-ff7be12a9d4e/

VMRay SmokeLoader

Malware family:

SmokeLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4d49d50b59d8/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4d49d50b59d87b380045384e5b23ddcd57ee91c3cc52c63457fe94554f67cd3a