MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e440e04f382464db10245c9f730d64d839368ef763bb564deadcacafb24e32b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs 6 YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e440e04f382464db10245c9f730d64d839368ef763bb564deadcacafb24e32b
SHA3-384 hash: 7da87258403645fe2699e1d985f2ef27509db0eadd41030751b352fabf0ccddc891b1dfb65a7fff54a88ea21d21c9a75
SHA1 hash: 98a5054d035323b02d8e513994231c08ebbba5b6
MD5 hash: 51f897624058278c2e5e68bc78f30c51
humanhash: jig-india-asparagus-indigo
File name:5E440E04F382464DB10245C9F730D64D839368EF763BB.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'341'398 bytes
First seen:2022-07-30 20:40:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c05041e01f84e1ccca9c4451f3b6a383 (141 x RedLineStealer, 101 x GuLoader, 64 x DiamondFox)
ssdeep 98304:JjLsKyx5WGdEM00g6ERrLxAJX+IpuJixtgPL:JfsvxsAXgRhenVyPL
TLSH T10CF533226F6A2062F7702BBB0E7D4E163F34E76843056E079F161B2D7B185A2C6B1717
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.106.191.165:39482

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://95.217.244.216/517 https://threatfox.abuse.ch/ioc/840131/
193.106.191.165:39482 https://threatfox.abuse.ch/ioc/840346/
185.215.113.216:21921 https://threatfox.abuse.ch/ioc/840398/
89.39.104.85:24947 https://threatfox.abuse.ch/ioc/840406/
85.239.53.186:80 https://threatfox.abuse.ch/ioc/840407/
185.219.221.87:22469 https://threatfox.abuse.ch/ioc/840408/

Intelligence

File Origin
# of uploads :
1
# of downloads :
467
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/295284/
Detection(s):
Win.Packed.Barys-9859531-0
Create hunting rule

Win.Malware.Generic-9863888-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Win.Packed.Trojanx-9873669-0
Create hunting rule

Win.Packed.SmokeLoader-9873637-1
Create hunting rule

Win.Dropper.Malwarex-9882460-0
Create hunting rule

Win.Malware.Malwarex-9882661-0
Create hunting rule

Win.Malware.Malwarex-9882703-0
Create hunting rule

Win.Dropper.Malwarex-9882944-0
Create hunting rule

Win.Malware.Upatre-9882649-1
Create hunting rule

Win.Malware.Upatre-9882660-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
Moving a recently created file
Running batch commands
Sending a custom TCP request
DNS request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Creating a process with a hidden window
Creating a window
Launching cmd.exe command interpreter
Launching a process
Unauthorized injection to a recently created process
Query of malicious DNS domain
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/27853/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
80%
Tags:
barys glupteba overlay packed shell32.dll smokeloader wacatac
Link:
https://www.filescan.io/uploads/62e597a0c4ff0c95024e105e/reports/07a8836a-735b-4838-baf0-c06149a082c4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Bsymem
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3f75b056-95ad-47b2-aeaf-8b944080d314
Result
Threat name:
Nymaim, RedLine, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1043630
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Checks if the current machine is a virtual machine (disk enumeration)
Connects to a pastebin service (likely for C&C)
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Disable Windows Defender real time protection (registry)
DLL reload attack detected
Drops PE files to the document folder of the user
Drops PE files with a suspicious file extension
Found C&C like URL pattern
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Performs DNS queries to domains with low reputation
Renames NTDLL to bypass HIPS
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected Nymaim
Yara detected RedLine Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 676120 Sample: 5E440E04F382464DB10245C9F73... Startdate: 30/07/2022 Architecture: WINDOWS Score: 100 141 live.goatgame.live 2->141 143 s.lletlee.com 2->143 145 22 other IPs or domains 2->145 179 Snort IDS alert for network traffic 2->179 181 Multi AV Scanner detection for domain / URL 2->181 183 Malicious sample detected (through community Yara rule) 2->183 189 18 other signatures 2->189 14 5E440E04F382464DB10245C9F730D64D839368EF763BB.exe 10 2->14         started        signatures3 185 May check the online IP address of the machine 141->185 187 Performs DNS queries to domains with low reputation 143->187 process4 file5 139 C:\Users\user\AppData\...\setup_installer.exe, PE32 14->139 dropped 17 setup_installer.exe 16 14->17         started        process6 file7 93 C:\Users\user\AppData\...\setup_install.exe, PE32 17->93 dropped 95 C:\Users\user\AppData\Local\...\sahiba_3.txt, PE32 17->95 dropped 97 C:\Users\user\AppData\Local\...\sahiba_2.txt, PE32 17->97 dropped 99 11 other files (1 malicious) 17->99 dropped 20 setup_install.exe 1 17->20         started        process8 dnsIp9 161 127.0.0.1 unknown unknown 20->161 163 watira.xyz 20->163 165 live.goatgame.live 20->165 115 C:\Users\user\AppData\...\sahiba_8.exe (copy), PE32+ 20->115 dropped 117 C:\Users\user\AppData\...\sahiba_6.exe (copy), PE32 20->117 dropped 119 C:\Users\user\AppData\...\sahiba_4.exe (copy), PE32 20->119 dropped 121 5 other files (2 malicious) 20->121 dropped 215 Performs DNS queries to domains with low reputation 20->215 25 cmd.exe 1 20->25         started        27 cmd.exe 1 20->27         started        29 cmd.exe 1 20->29         started        32 8 other processes 20->32 file10 signatures11 process12 signatures13 34 sahiba_6.exe 40 25->34         started        39 sahiba_7.exe 27->39         started        225 Obfuscated command line found 29->225 227 Uses ping.exe to sleep 29->227 229 Drops PE files with a suspicious file extension 29->229 231 Uses ping.exe to check the status of other devices and networks 29->231 41 sahiba_1.exe 2 29->41         started        43 sahiba_4.exe 2 32->43         started        45 sahiba_2.exe 1 32->45         started        47 sahiba_8.exe 32->47         started        49 2 other processes 32->49 process14 dnsIp15 147 212.193.30.115, 49851, 49934, 80 SPD-NETTR Russian Federation 34->147 149 193.106.191.165, 39482, 49852, 49928 BOSPOR-ASRU Russian Federation 34->149 159 15 other IPs or domains 34->159 101 C:\Users\...\mCf_gfili0k145eJdgJ_dnee.exe, PE32 34->101 dropped 103 C:\Users\...\XEdHW3t5kjMGDzH1DqAG17Qm.exe, PE32 34->103 dropped 105 C:\Users\...\VlRsxWOfS_NN1Tp68LvtSSke.exe, PE32 34->105 dropped 113 17 other files (15 malicious) 34->113 dropped 197 Drops PE files to the document folder of the user 34->197 199 May check the online IP address of the machine 34->199 201 Tries to harvest and steal browser information (history, passwords, etc) 34->201 203 Disable Windows Defender real time protection (registry) 34->203 51 MDjx9JW1E2MunaO5p8gDZLaX.exe 34->51         started        54 O16cGw_cX_CKCoC7qXvzs_51.exe 34->54         started        57 21Xr44gwvR3OghJl_TVCSGIO.exe 34->57         started        70 6 other processes 34->70 107 C:\Users\user\AppData\Local\...\Compatto.rtf, ASCII 39->107 dropped 59 cmd.exe 39->59         started        61 sahiba_1.exe 1 41->61         started        109 C:\Users\user\AppData\Local\...\sahiba_4.tmp, PE32 43->109 dropped 205 Obfuscated command line found 43->205 64 sahiba_4.tmp 43->64         started        111 C:\Users\user\AppData\Local\Temp\CC4F.tmp, PE32 45->111 dropped 207 DLL reload attack detected 45->207 209 Renames NTDLL to bypass HIPS 45->209 211 Checks if the current machine is a virtual machine (disk enumeration) 45->211 66 explorer.exe 45->66 injected 151 s.lletlee.com 47->151 153 pcfixmy-download-96.xyz 47->153 155 live.goatgame.live 47->155 213 Performs DNS queries to domains with low reputation 47->213 157 shpak125.tumblr.com 74.114.154.18, 443, 49771 AUTOMATTICUS Canada 49->157 68 WerFault.exe 49->68         started        file16 signatures17 process18 dnsIp19 191 Detected unpacking (changes PE section rights) 51->191 193 Detected unpacking (overwrites its own PE header) 51->193 123 C:\Users\user\AppData\Local\Temp\...\File.exe, PE32 54->123 dropped 125 C:\Users\user\AppData\Local\...\SETUP_~4.EXE, PE32 57->125 dropped 127 C:\Users\user\AppData\Local\...\SETUP_~2.EXE, PE32 57->127 dropped 72 cmd.exe 59->72         started        76 conhost.exe 59->76         started        171 s.lletlee.com 61->171 173 live.goatgame.live 61->173 177 2 other IPs or domains 61->177 78 conhost.exe 61->78         started        175 requested404.com 99.83.154.118, 49772, 80 AMAZON-02US United States 64->175 129 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 64->129 dropped 131 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 64->131 dropped 133 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 64->133 dropped 195 Creates HTML files with .exe extension (expired dropper behavior) 64->195 80 conhost.exe 70->80         started        file20 signatures21 process22 file23 135 C:\Users\user\AppData\...\Triste.exe.com, PE32 72->135 dropped 217 Obfuscated command line found 72->217 219 Uses ping.exe to sleep 72->219 82 Triste.exe.com 72->82         started        84 findstr.exe 72->84         started        86 PING.EXE 72->86         started        signatures24 process25 process26 88 Triste.exe.com 82->88         started        dnsIp27 167 s.lletlee.com 88->167 169 XvFGsHKHPpgkvS.XvFGsHKHPpgkvS 88->169 137 C:\Users\user\AppData\Local\...\RegAsm.exe, PE32 88->137 dropped 221 Writes to foreign memory regions 88->221 223 Injects a PE file into a foreign processes 88->223 file28 signatures29
Detection:
vidar
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5e440e04f382464db10245c9f730d64d839368ef763bb564deadcacafb24e32b/
Threat name:
Win32.Trojan.Crypzip
Create hunting rule
Status:
Malicious
First seen:
2021-07-28 00:53:16 UTC
File Type:
PE (Exe)
Extracted files:
145
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lzca4bhtqjde3micixe7omgwjwbzg2hpoy53kzg6vxfmv6ze4mvq._file
Verdict:
malicious
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:djvu family:nymaim family:privateloader family:raccoon family:vidar botnet:706 botnet:afb5c633c4650f69312baef49db9dfa4 aspackv2 evasion loader persistence ransomware spyware stealer trojan
Link:
https://tria.ge/reports/220730-zgek1sgcgl/
Behaviour
Checks SCSI registry key(s)
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
ASPack v2.12-2.42
Downloads MZ/PE file
Executes dropped EXE
Vidar Stealer
Detected Djvu ransomware
Djvu Ransomware
Modifies Windows Defender Real-time Protection settings
NyMaim
PrivateLoader
Raccoon
Raccoon Stealer payload
Vidar
Malware Config
C2 Extraction:
https://shpak125.tumblr.com/
http://77.73.132.84
http://acacaca.org/test3/get.php
208.67.104.9
212.192.241.16
Unpacked files
SH256 hash:
89a0227ef833a2742f7dd46be36e61b178a8b47846fd3cf557c8b9991b7cfb67
MD5 hash:
55bf2bbdd87ec3ac709c6a247f4a28b4
SHA1 hash:
6df7d9af3a7b2da1c91aff955a4c5aadbe2d13cb
Detections:
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
Parent samples :
5e440e04f382464db10245c9f730d64d839368ef763bb564deadcacafb24e32b
ab479d019576efd4dd391e0bf3fc1bedb10367e1ece7157d609a283873a43645
ef0c34580084f9855c1e5c3fa9d902688d400baabc7366c8da9ba3d4b708da49
ec306f0a108c77a02ab48c5c85296c4b3b7d4b690245f9dd8a67df774b641cf8
e3135f01a3b76a91bb1082fd5b53259fe2d59eb6ab550fcc6fa6c866412920f8
e52e6bbf7705f9b90e4a20f2935cb86ee6078035f14d873d1c126c6ba9ccc551
27425ab21814acdc92665957ce92f326a46ea99131ef32df83ccaeaaa5228c20
55f22aa33b837e543e8a58408ed843e41515292dead43b57b2ae42b735c34f11
d0037be72720bb05c0207342411a883b883c8f4a371c6c7e6bacd9cff5615df7
20e1bc5813941642186774cd0aa40989c3d119d7a70b7a6be5d3d8df6185c020
cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
e026bc9a0b7ac31a86cdbbd88e2b2be5236ba81b469723007c8b3c1d9461198f
e461562a06f4c2cea8cc91d9fc6fd75f393b79030d6463169f71b0ff2f6b7ded
8f8b341230323b995c1cde1d534031092bfddb56411dac43d155e5366681e1c7
SH256 hash:
c204948f88c6d384b39069c2c5c69ed62105ee73f391ff105b3e36081f12fc5d
MD5 hash:
cd8b4ea3aa92a0ed9eee929b3585c711
SHA1 hash:
da430a7a38bd3c7ad75ab6e9ed4a4ca6a077ac54
Detections:
win_vidar_auto
Create hunting rule
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
Parent samples :
5e440e04f382464db10245c9f730d64d839368ef763bb564deadcacafb24e32b
ec306f0a108c77a02ab48c5c85296c4b3b7d4b690245f9dd8a67df774b641cf8
SH256 hash:
273d00e42dfb2ce9af1225f2062681309fccbaac50446c3088c26f0af4662c0f
MD5 hash:
fa660324ad5afcf91f3120c72ba2036e
SHA1 hash:
d1845313a515e3317f3ccc867c48a32f49889647
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
SH256 hash:
30b9f240631bdab5870096675ecd56b6c1b1875ef332104f46993730fe92b91e
MD5 hash:
34891d807c3aed97dde4cb331e340513
SHA1 hash:
96d1b5fdfa2e9e23020cfcf42beeb04bf00cce75
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
SH256 hash:
50df788859ce3024e9018f60f7c04aa43c191de7b1578fdbebc7478898d5cd8d
MD5 hash:
9db9ef06359cce014baef96fa69b5a7c
SHA1 hash:
614c739b69be9a3914a9ca9548245ed2c97ceb63
Detections:
win_privateloader_a0
Create hunting rule
win_privateloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
SH256 hash:
bfebe04424e0a8621eb53d2d6da9d5c969e4b94e33ea532bb70e9212869ee9eb
MD5 hash:
28ddc420be08a62b8da803d14d0bcb93
SHA1 hash:
587ca5df9f7fdd3c6915f801f8cd15057342193f
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
SH256 hash:
6ea92579c10ff6128399ec8092b44388da56b89e83103797601d334d6c866ca0
MD5 hash:
f14bcba48fb3817154228ed4cf9df6cb
SHA1 hash:
26ae758142d6dd0d69d5f4ff127a0d9c633b6690
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
SH256 hash:
78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
MD5 hash:
c0d18a829910babf695b4fdaea21a047
SHA1 hash:
236a19746fe1a1063ebe077c8a0553566f92ef0f
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
SH256 hash:
e1cc6a9d780602fe6e789bf5c3a27e87e197a4e3bf7c8138ea2f9dfec70fb963
MD5 hash:
f707252b9c9579677fffb013e0cfc646
SHA1 hash:
8ab483023fa8773afb8c13464c39c5b8e687f126
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
SH256 hash:
e427f8ef21691e3d8c2313d11129ad08ddef69a158eca2f77c170603478ff0c4
MD5 hash:
0dedd909aae9aa0a89b4422106310e9e
SHA1 hash:
271d36afa5b729ee590cf8066166ca5e9c9d0340
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
SH256 hash:
ffc0ae6888aba7f287c57f829723f7ab70dcf0c42b08f28c4764e7c7cd5e3dd7
MD5 hash:
7c35ca7e2fc57c3fdb8ef3f5551c03fd
SHA1 hash:
db4404e40c233101f6eb8377331c7a4bd99ffa6d
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
SH256 hash:
be3736cd03567a0b41e8f9f3ae049bc10efe842bf65d69fcc1e07ea96da81060
MD5 hash:
26a6ee502ed2ab267995add177a145fc
SHA1 hash:
9b6f56e7ae2e49c9cd1231afc27661eab1ffb9bb
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
SH256 hash:
d0c2208cac9cf894507b4d442c821dc2d85fd7fbb0d0ff5bc181cec4b3bfc6b9
MD5 hash:
7d0827371ad8d2a3c017fdd9b380edd3
SHA1 hash:
c2c1f423b6d22dc91b69e2261bd447e7f9f18640
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
Parent samples :
c9e1de1c6ddd3ffd9c87ebdbcf9bd5b7064af9f60f650ae50573b05a49af8327
1e71bcb4133949eaa1bead27b4e01f03f7802c6b92f61acbb6b8d7c8faf419d7
3ecf5237981fc6575586fe2e13f9afe240b132b58d7bc071296ec3816b150d26
bbfda112b2d2742ec593b14cf9a0d2558cedaa24ae89d0cc9b5c94b94705c772
feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36
f8387262e71195a4db4a0ca0fe68b973e225b8dfe7b475580d19240a760d1e73
fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693
5e30143f53af82ff891d9801ccff6b30e3dc7f3401bba597accb26e2d3b8b25d
fa5995b67f40f6c2cf7f3edba1e5a2213f2b083a35b13503af7a6203b4b8c33a
a6b218813c937087c078983f17d2520b0c2e7ad5d0cc41bfdf1d0cb540e4470a
440a157bbd8c8332d4edc63e6dc1399777e73bfb7ef3c5a356ab98fa56d1feea
95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874
007c6dfe4466894d678c06e6b30df77225450225ddd8e904e731cab32e82c512
9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba
c71463ac4fb8dd985b249b61e54888137bea84dab7c202546e230eb450fc0969
34b896d2e6470b2bd8facb9a796e0a521b78ec4956a573b5b38cacdc42622caa
8b738c9057baa2c3219120919226e95659cccec0dc61aca579bba58c7090719e
f6b2cd5327818418db45f70ed99bc6751d836eaf503a9bf33602af0c74f61e83
b426a6cb4005e266bf9b91b30d46fbbd0d6c541ac40d295aa99b8b7ef45e0edf
d43af0c0a5058412c903698b4ac55f150f6a20cac43344b5a596906780dac1f7
b4ca0b94b1a4e5b2ed28ad66c2df781b5add3c46cf5232b64b3a5253bcc341e8
1d40c76cecaabdf1e1d0004aa15cb469aa4374d1d0b2e48a47e588b1f84113d6
afdb413119fa2e0755a4885146d44547b97096d700d2b1236c6aba8f9bb9719d
7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91
d11d8d13e611c17ae61db286984170b2eb6802d2c23630e3211b9cfddaef09e6
d1dae6a275073c722606d35b783b4d176c0d8e0feff6c903c27ab9f0f8d7ab07
7c86e8c4143be0e27af9558ca46b3b4d7c5bee5e58e18902757bc02f6a3863a2
28319673d8f382142e223302ede1e0e497ccac2cd7a9814715726335e78c29c7
b130fe2fceada2a1980b6a0015c1bc1a9c1ee08f6229d99e43de82351da541fa
48a4042854a402824d35f4c95aed1e448d652d79ed0c251635acbc073200dfcf
e1f193deaa71595b668320d294635988f66c0f1ab1ab218e08fe3ae87fe10838
90f608b784fc8eac0a899d6aec257ec4beaf836e0cc808c7496f131aba61bef0
8435702911a3d6ebac7acef5aff7bc30395427892c1ddf39647b912a93260258
5bbb7a91ebfa925b0765103006bdde91f19c648ae792fab9dbc73832f3b2423c
SH256 hash:
031bb6cb0f6f2c60da3b921dba7f7a1a4f5ae93bf75813d37d2246ce82cbedb9
MD5 hash:
43662b337c8c320fbfaa3510079644a9
SHA1 hash:
46f17d17c1e60a23f39bf97d90a5a48d4fc12d89
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
SH256 hash:
5e440e04f382464db10245c9f730d64d839368ef763bb564deadcacafb24e32b
MD5 hash:
51f897624058278c2e5e68bc78f30c51
SHA1 hash:
98a5054d035323b02d8e513994231c08ebbba5b6
Link:
https://www.unpac.me/results/914e1e08-0c5c-4091-a7ac-b3e2d4ac5f7c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e440e04f382464db10245c9f730d64d839368ef763bb564deadcacafb24e32b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:INDICATOR_EXE_Packed_ASPack
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ASPack
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:MALWARE_Win_DLInjector03
Create hunting rule
Author:ditekSHen
Description:Detects unknown loader / injector
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:RedOctoberPluginCollectInfo
Create hunting rule
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_vidar_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.vidar.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/295284/

Comments