MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 530e0002c120d13962f54641655060f420625a3ee39b740dac62a644bda96ede. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 530e0002c120d13962f54641655060f420625a3ee39b740dac62a644bda96ede
SHA3-384 hash: 0de8942c27aea32bc12a3f0649888af4e53445af9eac5df0de0ef73d0f3a198e6b567f15074d22aa312026289f7a14c8
SHA1 hash: 21003f104ad009faeacad105d55901c44bf173c4
MD5 hash: a8189f9faac3bd2f1b8ef9de7138ec33
humanhash: green-delaware-coffee-mexico
File name:a8189f9faac3bd2f1b8ef9de7138ec33.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:6'812'989 bytes
First seen:2021-12-19 04:31:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 32569d67dc210c5cb9a759b08da2bdb3 (122 x RedLineStealer, 42 x DiamondFox, 37 x RaccoonStealer)
ssdeep 196608:xKLUCga8PB48QZRb0dC6x8n3RFOymHq1qr6Xkqo8gQXogOPD:xKdgaS68sY/GhFOTK1HkqobQXogeD
TLSH T1136633543D98D1FEE7450D30DF84DA72A4F88A989760EEE3E7C178886F74296202E5C7
File icon (PE):PE icon
dhash icon 848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
45.9.20.240:46257

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.9.20.240:46257 https://threatfox.abuse.ch/ioc/277335/

Intelligence

File Origin
# of uploads :
1
# of downloads :
241
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DLInjector03
Create hunting rule
Link:
https://www.capesandbox.com/analysis/215236/
Detection(s):
Win.Packed.Barys-9859531-0
Create hunting rule

Win.Trojan.Jaik-9862236-0
Create hunting rule

Win.Malware.Generic-9863888-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Searching for the window
Running batch commands
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Launching a process
Using the Windows Management Instrumentation requests
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/2584/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
arkeistealer barys mokes overlay packed
Link:
https://www.filescan.io/uploads/61beb5c68991ba72b38c45a9/reports/77c222fb-4cb2-4905-af98-f1a68afb2120/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
Backstage Stealer SmokeLoader Socelars V
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/909741
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates HTML files with .exe extension (expired dropper behavior)
Disable Windows Defender real time protection (registry)
Disables Windows Defender (via service or powershell)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Sample uses process hollowing technique
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Backstage Stealer
Yara detected SmokeLoader
Yara detected Socelars
Yara detected Vidar stealer
Yara detected WebBrowserPassView password recovery tool
Yara Genericmalware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 542219 Sample: dmrVSK0ZIh.exe Startdate: 19/12/2021 Architecture: WINDOWS Score: 100 62 151.115.10.1 OnlineSASFR United Kingdom 2->62 64 52.182.143.212 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 2->64 66 6 other IPs or domains 2->66 84 Antivirus detection for URL or domain 2->84 86 Antivirus detection for dropped file 2->86 88 Multi AV Scanner detection for dropped file 2->88 90 14 other signatures 2->90 9 dmrVSK0ZIh.exe 22 2->9         started        signatures3 process4 file5 42 C:\Users\user\AppData\...\setup_install.exe, PE32 9->42 dropped 44 C:\Users\user\AppData\...\Thu13fcd568e46.exe, PE32 9->44 dropped 46 C:\Users\user\...\Thu13d88cc421ce6a2.exe, PE32 9->46 dropped 48 17 other files (9 malicious) 9->48 dropped 12 setup_install.exe 1 9->12         started        process6 dnsIp7 80 172.67.217.227 CLOUDFLARENETUS United States 12->80 82 127.0.0.1 unknown unknown 12->82 114 Adds a directory exclusion to Windows Defender 12->114 116 Disables Windows Defender (via service or powershell) 12->116 16 cmd.exe 12->16         started        18 cmd.exe 1 12->18         started        20 cmd.exe 12->20         started        22 10 other processes 12->22 signatures8 process9 signatures10 25 Thu1338a9d0a9ffe.exe 16->25         started        30 Thu1320eb63250ae.exe 3 18->30         started        32 Thu1348291ee5e377d2.exe 20->32         started        92 Adds a directory exclusion to Windows Defender 22->92 94 Disables Windows Defender (via service or powershell) 22->94 34 Thu139e8d7be6e5.exe 22->34         started        36 Thu13fcd568e46.exe 22->36         started        38 Thu130edcdacfa993.exe 7 22->38         started        40 4 other processes 22->40 process11 dnsIp12 68 185.215.113.208 WHOLESALECONNECTIONSNL Portugal 25->68 70 103.155.92.143 TWIDC-AS-APTWIDCLimitedHK unknown 25->70 76 18 other IPs or domains 25->76 50 C:\Users\...\JSRshBYum_UAtcEITzZsrGWY.exe, PE32 25->50 dropped 52 C:\Users\user\AppData\...\Setup32[1].exe, PE32 25->52 dropped 54 C:\Users\user\AppData\...\toolspab2[1].exe, PE32 25->54 dropped 60 34 other files (11 malicious) 25->60 dropped 96 Antivirus detection for dropped file 25->96 98 Creates HTML files with .exe extension (expired dropper behavior) 25->98 100 Tries to harvest and steal browser information (history, passwords, etc) 25->100 102 Disable Windows Defender real time protection (registry) 25->102 104 Machine Learning detection for dropped file 30->104 106 Sample uses process hollowing technique 30->106 108 Injects a PE file into a foreign processes 30->108 110 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 32->110 112 Checks if the current machine is a virtual machine (disk enumeration) 32->112 56 C:\Users\user\AppData\Local\Temp\lVq04Ch.tk, PE32 38->56 dropped 72 208.95.112.1 TUT-ASUS United States 40->72 74 148.251.234.83 HETZNER-ASDE Germany 40->74 78 3 other IPs or domains 40->78 58 C:\Users\user\AppData\Local\Temp\11111.exe, PE32 40->58 dropped file13 signatures14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/530e0002c120d13962f54641655060f420625a3ee39b740dac62a644bda96ede/
Threat name:
Win32.Backdoor.Zapchast
Create hunting rule
Status:
Malicious
First seen:
2021-12-17 02:35:00 UTC
File Type:
PE (Exe)
Extracted files:
304
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kmhaaawbeditsyxvizawkuda6qqgewr64onxidnmmktejpnjn3pa._file
Verdict:
malicious
Label(s):
ryuk
Create hunting rule
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader family:socelars family:vidar botnet:915 botnet:media16n botnet:v3user1 aspackv2 backdoor discovery evasion infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/211219-e5yzcafha9/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Looks up geolocation information via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
ASPack v2.12-2.42
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
NirSoft WebBrowserPassView
Nirsoft
Vidar Stealer
Modifies Windows Defender Real-time Protection settings
Process spawned unexpected child process
RedLine
RedLine Payload
SmokeLoader
Socelars
Socelars Payload
Suspicious use of NtCreateUserProcessOtherParentProcess
Vidar
Malware Config
C2 Extraction:
http://www.biohazardgraphics.com/
https://noc.social/@sergeev46
https://c.im/@sergeev47
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
159.69.246.184:13127
65.108.69.168:13293
Unpacked files
SH256 hash:
e7b8877389f0bfb5fb95f08a799a0e7d06a2f7161a0287552ff3eadf06bd1dd1
MD5 hash:
e9eb471509abbfb4456285e82b25d1c9
SHA1 hash:
b96ef576c147ea8a1b3e0bd5430117ba9ad31096
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
a6fe15069a6ea98b42471503e427375cdf14b92fd6bf6f69a21dbe2e1a675c98
MD5 hash:
26f0fa618a849f4c2c8a054bb41583d2
SHA1 hash:
2d34f74fafe0c0042e567858ed8a8601ce250d14
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
Parent samples :
3f947f5a849f11be9079a5c2418240e2faf7e53b63662c85b92fad8f47ea4d09
6a42f7e5290bf7e40e1aa0c0e9ceda098a612d6dda9b7fa613e0c3a58b16b826
SH256 hash:
de97b6f316e9965dd362c60a734b5fb028a48debf7c37b6eb3d7a1936a8684b4
MD5 hash:
170f298b03cc53b23412bff2f6cd58c1
SHA1 hash:
e86186581f03a945386bd3356ad1fa4e363161c2
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
1b7ec4b2c8faccbc0ecdf81bb34c7ebe5e9ef6d2ee9d1ec13860672407c218f8
MD5 hash:
7f1129c928a580282af8280501b66253
SHA1 hash:
e782ae50667f669a62332cd3f517c137eb37c376
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
d5a85cb1c8e0ca4ff26b10981865245e6338d3e1d0b099060b2da05106c8c63e
MD5 hash:
32e7a1755f4801c31cef6424741e69f2
SHA1 hash:
e6f01f00f7803bebc61952b67d14bc022a46d503
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
7fe3f488a2ac6b5648716f4bdd496915c461d3e4df961fb921db50c21b7f660b
MD5 hash:
8b911d6d6ffb72f5f8a54ca8a25b69f5
SHA1 hash:
c4a934507ba5d2e1a28a1a1c128f46adb70e8975
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
ec8dd6f231977cfbfda8a93026b6de21b8b348d3c4b50ee7d14558e262d458bd
MD5 hash:
17aed25a1524e588ed39d9772fb54bd9
SHA1 hash:
c2a4ae84a51468b0412a2f314ee4b7cd3d1696ee
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
772640f74c9365475f0122224704c230a362ca538934218142716c7b0fe4e956
MD5 hash:
8e991f1ad286f20c722807ba9bb6393a
SHA1 hash:
bc0138b868645decc28b317ad195b4de1d1e7e2b
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
8deaf50a725619537695eae5b4bef370705eecec40882ceeb24869737777fe6d
MD5 hash:
3c3a6283fe69a7c706401b6952d6f8e9
SHA1 hash:
ba6c6285f055712ff238ec06a412b07137e15d22
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
fb5e44afa9b86e8d68f158b58036682dc28b8e3ed0d5391ffcd246f5bd8dec99
MD5 hash:
4c120576caedf379e15621df6328dfc0
SHA1 hash:
af3ddbcb753c2609d1b1c0985984a0957d9d0d0f
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
99f0b7f3850cf910e41e4f5ddb3a0dc31b8aacbd786ac4baf2d8da957688934f
MD5 hash:
081b25efff8d8aa6270f74b2785c3aec
SHA1 hash:
a516b6adca827f8f22579a56b7edec4816d4bcce
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
505525d02e8a74b722bab1f9c575b129d262d26f2bbf992d7d6cd061d12f5774
MD5 hash:
74b7db6bacb3c950c5db479bf728cf21
SHA1 hash:
a11f635ab3cba8cd9d7434ab2df55c706a424a3d
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
ceeedbba092ea2e6661cbcca2d6b153926632221602ea292641b544cca9a5e95
MD5 hash:
cdcb3963993e2c3f3b00c21a122fdfb5
SHA1 hash:
8e680465b3a1112de13b76539a073fad0b2b423c
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
dcc1725b855ec8f21f1a78a72bc3951682a20709b129d16051cbbbfca2361c2a
MD5 hash:
851857aa313098b41716720126d1e9e1
SHA1 hash:
748d3a025f04a0526678af71a341097570c88e7e
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
7ce7b48690678b44c53a5511f3dd22871637b33e4ccc0a56bb934c7e87c5e8e3
MD5 hash:
69662c82d93044ae0ba449452bb041aa
SHA1 hash:
1124213f82331b4281562665bf0c504dbe36cc31
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
a3ac94323b95cfdc334dcfb7ec52aaad4fe2940a4bc154e988aa753cbed1e1a0
MD5 hash:
acfe6afb1b5fb76cf4ae7c7de4571877
SHA1 hash:
0e2eb9897aa28aa9f9487841cbef6711662a1495
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
cf1ed8957d4825743d39f19529138de7131ca8f506440ddc1774f4640dffc599
MD5 hash:
ded1c6e8c89148495fc19734e47b664d
SHA1 hash:
3a444aeacd154f8d66bca8a98615765c25eb3d41
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
Parent samples :
3f947f5a849f11be9079a5c2418240e2faf7e53b63662c85b92fad8f47ea4d09
6a42f7e5290bf7e40e1aa0c0e9ceda098a612d6dda9b7fa613e0c3a58b16b826
d6ec737d10afdaf38cafede9fde045dd3ce7bc72c6ee13df33e018f0e7149893
SH256 hash:
012c3d22b5374c4f595fcf1986bf2a67697f322f36e8bb6456809334f98f5781
MD5 hash:
8bacb64db8fb73308faefd14b863fd43
SHA1 hash:
c5bf54f8b9cc198d6d380f3ee7a74df2feadf32a
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
9dac78cf97a753e813b02cb654f076cdea03155bc9a98ed64ec248729ead52ec
MD5 hash:
29fa5c5ade39d4ae5a0f564949278923
SHA1 hash:
376051004220051779d97fcb44065a8724de370b
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
a7e37f5314834b163fa21557e61c13c0f202fd64d3c0e46e6c90d2d02e033aec
MD5 hash:
6faec01bf7a3d7f5c5dee2e6e3143a58
SHA1 hash:
603a36f817cab5574e58ab279379e5c112e5fb37
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
fdfcbc8cfb57a3451a3d148e50794772d477ed6cc434acc779f1f0dd63e93f4b
MD5 hash:
a6865d7dffcc927d975be63b76147e20
SHA1 hash:
28e7edab84163cc2d0c864820bef89bae6f56bf8
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
8a6e94dc7e45b8fa8ef520c5fdc283c3ea522ac88dfcf9c5cdb9924a8b4910da
MD5 hash:
8a3324a3a37ed1546b2bd7756a6e62a5
SHA1 hash:
ea8556905585805aca15f8af40bd0ccd8dd05317
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
b8acc1c748d7e3342609776681deaa9a936b0c2988893b83853a02ed5a22be9a
MD5 hash:
3ea9f29bbd04a3956fb3e6ba9f90e530
SHA1 hash:
f19698d92fd1192f12b11bc50c17fe429567bd60
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
b2f383bf7f45d222a7607ac2df262a8b12752f6bb2dd963897d24d103c4da1b0
MD5 hash:
493306cc212e55a9676e8c4394a1d895
SHA1 hash:
3e0a7bb2a8f5cd4795bec156ec773158bfce3373
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
e76ce4fcf0b6c15b414431f14872263e2423710d665f57173dbb9d40bdb853bb
MD5 hash:
f26390aaa12b8602275885ad1e156c7a
SHA1 hash:
e8eb041563f765a5d5fda946ce3a9619496bff8e
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
cc00a6a461d59959c58e85191fc42c1a63c7dc8fbf577cdfc0e59c0c24b0644b
MD5 hash:
89e8f115b3c4b3f74350f39ef064f8f1
SHA1 hash:
b25d98d9d2cd1bbf362a65ef672644c14577b99d
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
87fe220a5c5ada3e91c769b661a1b990aa2db34a660e43a546578b8ccbba00be
MD5 hash:
078d51402b9a45719554e3708f076cf2
SHA1 hash:
f42082a96ee88f6cce5f1e084b427fc538f8360e
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
784f16c1095a82f3595303e3fde40bfc129e1e74dc69305029b918f430c98fef
MD5 hash:
baf9daa3af36c985fac439c0ca4417fb
SHA1 hash:
d07adafdb7e02104bd3073b6f0a75a6ace076c1c
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
SH256 hash:
530e0002c120d13962f54641655060f420625a3ee39b740dac62a644bda96ede
MD5 hash:
a8189f9faac3bd2f1b8ef9de7138ec33
SHA1 hash:
21003f104ad009faeacad105d55901c44bf173c4
Link:
https://www.unpac.me/results/8985141e-118a-4026-b12a-9c4bf8863a2b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/530e0002c120d13962f54641655060f420625a3ee39b740dac62a644bda96ede

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/215236/

Comments