MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fa28556557b228a0cabb6a51597217e09afdf58a140b1181f0bd8325e6e4d0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Hive


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fa28556557b228a0cabb6a51597217e09afdf58a140b1181f0bd8325e6e4d0f
SHA3-384 hash: 4456640a1692ecd9b25d6910eea840d80ee928130e273680482f56c45055f2e1f5a6c2eddf80a2eff702521a91f978aa
SHA1 hash: bb50724ad72d3a71180abb97fcda248830af3147
MD5 hash: a3110bd6f1ee209bcf0e8c09c8430815
humanhash: red-jersey-jersey-mirror
File name:Setup.exe
Download: download sample
Signature Hive
Create hunting rule
File size:8'211'118 bytes
First seen:2022-02-09 17:37:06 UTC
Last seen:2022-02-19 02:56:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (719 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 196608:TMOvSI2Cxl4YXZ0yXUYVebIjuz6wQcJUg9jUL/poq:TMOvNfl4YX2yXzevz1QGUg95q
TLSH T1DA8633E4CDF0FD29D205E0B6F4B0A13C72CF1D289D215426E686F94E28618DA95FAF17
File icon (PE):PE icon
dhash icon 00414f4f4f4f4700 (14 x CoinMiner, 12 x RedLineStealer, 12 x NodeLoader)
Reporter adm1n_usa32
Tags:exe Hive Redline

Intelligence

File Origin
# of uploads :
3
# of downloads :
295
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Setup.exe
Verdict:
Malicious activity
Analysis date:
2022-02-09 17:35:37 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/310196a0-a4b9-4040-9b32-8899986fb080

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/239780/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.25447.28407.14259.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
DNS request
Running batch commands
Creating a file in the %AppData% directory
Creating a process from a recently created file
Searching for the window
Using the Windows Management Instrumentation requests
Launching a process
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/6555/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll yakes
Link:
https://www.filescan.io/uploads/6203fc06a35489c8dafea9c7/reports/75882c87-6ec9-4343-b747-5122efe2d60f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7fb58084-fa4c-4bec-a5ac-121cca732687
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/937112
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file has nameless sections
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 569591 Sample: Setup.exe Startdate: 09/02/2022 Architecture: WINDOWS Score: 100 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus / Scanner detection for submitted sample 2->43 45 4 other signatures 2->45 7 Setup.exe 9 2->7         started        process3 file4 25 C:\Users\user\AppData\Roaming\2.exe, PE32+ 7->25 dropped 27 C:\Users\user\AppData\Roaming\1.exe, PE32 7->27 dropped 10 1.exe 7->10         started        13 2.exe 1 7->13         started        process5 dnsIp6 47 Multi AV Scanner detection for dropped file 10->47 49 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->49 51 Machine Learning detection for dropped file 10->51 57 4 other signatures 10->57 16 AppLaunch.exe 2 10->16         started        19 WerFault.exe 20 9 10->19         started        33 accounts.google.com 142.250.203.109, 443, 49688 GOOGLEUS United States 13->33 35 youtube-ui.l.google.com 216.58.215.238, 443, 49687 GOOGLEUS United States 13->35 37 www.youtube.com 13->37 53 Antivirus detection for dropped file 13->53 55 Tries to harvest and steal browser information (history, passwords, etc) 13->55 21 conhost.exe 13->21         started        23 cmd.exe 1 13->23         started        signatures7 process8 dnsIp9 29 185.128.107.100, 80 SUPERSERVERSDATACENTERRU Russian Federation 16->29 31 192.168.2.1 unknown unknown 19->31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4fa28556557b228a0cabb6a51597217e09afdf58a140b1181f0bd8325e6e4d0f/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2022-02-09 17:38:27 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j6rikvsvpmriudflw2srlfzbpye27x2yufalcga7bpmdextojuhq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  10/10
Tags:
spyware stealer upx
Link:
https://tria.ge/reports/220209-v7raaabcek/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
UPX packed file
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
6e5554596c4cf56b491992d0dd60504a6afb25fec79b76ff5d402e38f50379ba
MD5 hash:
149cc6abfa1b83319f716097911669e7
SHA1 hash:
a78ed3366359c09301c015b8544ad2e832fed747
Link:
https://www.unpac.me/results/f9f36f43-3893-433e-8add-b7134eeabd9e/
SH256 hash:
4fa28556557b228a0cabb6a51597217e09afdf58a140b1181f0bd8325e6e4d0f
MD5 hash:
a3110bd6f1ee209bcf0e8c09c8430815
SHA1 hash:
bb50724ad72d3a71180abb97fcda248830af3147
Link:
https://www.unpac.me/results/f9f36f43-3893-433e-8add-b7134eeabd9e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/4fa28556557b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/239780/

Comments