MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61167f2be099b7bf668e25a470119adfa0c409c2e5c059ad1a016c14dd168f3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61167f2be099b7bf668e25a470119adfa0c409c2e5c059ad1a016c14dd168f3f
SHA3-384 hash: bddfbce7bf55b2deeed31d1e6618f25ec38673c9b85b12bcd7f2e3eee056358f3ebd543bc356d1762c70eee083b79538
SHA1 hash: ea5bacbba4ebceacf4f7c547fc840d03fb8654f7
MD5 hash: 8cd6a0f9c54968b2003415a62a6ce8b7
humanhash: gee-fourteen-low-blue
File name:61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:219'648 bytes
First seen:2021-09-25 09:50:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4b405a935ba1896da801696a6c1a4ade (6 x RaccoonStealer, 4 x Smoke Loader, 1 x ArkeiStealer)
ssdeep 3072:VnV2TpS2xfwfsxiYS52wRTsScsYh6gSVywo3c+:WT/pwfAiT7knGyHM
Threatray 5'383 similar samples on MalwareBazaar
TLSH T17924BE113EBCD872D4950A30486ACBE4EA7FFD617A20114B37983B6FEE703912276359
File icon (PE):PE icon
dhash icon 4839b2b4e8c38890 (137 x RaccoonStealer, 37 x Smoke Loader, 30 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.215.113.29:18087

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.215.113.29:18087 https://threatfox.abuse.ch/ioc/226441/

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
main_setup_x86x64.exe
Verdict:
Malicious activity
Analysis date:
2021-08-11 10:31:00 UTC
Tags:
evasion trojan rat redline phishing
Link:
https://app.any.run/tasks/aa32fe53-e1e8-4a58-b7e4-5f9689016425

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/191492/
Detection(s):
Win.Packed.Dropperx-9885228-0
Create hunting rule

Win.Packed.Generic-9885285-0
Create hunting rule

Win.Packed.Generic-9885336-0
Create hunting rule

Win.Packed.Filerepmalware-9885370-0
Create hunting rule

Win.Packed.Generic-9885373-0
Create hunting rule

Win.Packed.Filerepmalware-9885375-0
Create hunting rule

Win.Packed.Generic-9885383-0
Create hunting rule

Win.Packed.Fragtor-9885503-0
Create hunting rule

Win.Packed.Generic-9885820-0
Create hunting rule

Win.Packed.Raccoon-9885627-1
Create hunting rule

Win.Packed.Generickdz-9889922-0
Create hunting rule

Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7b818d19-f12d-42a3-a37d-064bceadca77
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/857914
Signature
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 490346 Sample: 61167F2BE099B7BF668E25A4701... Startdate: 25/09/2021 Architecture: WINDOWS Score: 100 26 Multi AV Scanner detection for domain / URL 2->26 28 Found malware configuration 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 4 other signatures 2->32 6 61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exe 2->6         started        9 vdsbvgf 2->9         started        process3 signatures4 34 Detected unpacking (changes PE section rights) 6->34 36 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 6->36 38 Maps a DLL or memory area into another process 6->38 40 Creates a thread in another existing process (thread injection) 6->40 11 explorer.exe 2 6->11 injected 42 Multi AV Scanner detection for dropped file 9->42 44 Machine Learning detection for dropped file 9->44 46 Checks if the current machine is a virtual machine (disk enumeration) 9->46 process5 dnsIp6 20 nasufmutlu.com 11->20 22 thegymmum.com 11->22 24 4 other IPs or domains 11->24 16 C:\Users\user\AppData\Roaming\vdsbvgf, PE32 11->16 dropped 18 C:\Users\user\...\vdsbvgf:Zone.Identifier, ASCII 11->18 dropped 48 System process connects to network (likely due to code injection or exploit) 11->48 50 Benign windows process drops PE files 11->50 52 Deletes itself after installation 11->52 54 Hides that the sample has been downloaded from the Internet (zone.identifier) 11->54 file7 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61167f2be099b7bf668e25a470119adfa0c409c2e5c059ad1a016c14dd168f3f/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-08-11 14:31:45 UTC
AV detection:
28 of 28 (100.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=melh6k7atg336zuoewshaem236qmicoc4xaftli2afwbjxiwr47q._file
Verdict:
malicious
Similar samples:
328e682510e9c0e0c37a7c8d347ecb4e7791a03b44962675a3f5f23d85250e08
RedLineStealer
34fe9331ea2b5f3ec39ee18ada691b5d0a908a95c640253bd31b7a3a023d1a5f
RedLineStealer
39326cdd0c863e1766ecc3d119ec18fdaa93ef886cfbc887f76784f745df73e4
RedLineStealer
41ce43aa875bf977ec9eb039e5853ade1af522dd0dff4f19282f6c8038ae2dff
RedLineStealer
5f0caccb3ca599a30b5f298f9bb414fe721121c83b7bedc7c59ffe4128c96b61
RedLineStealer
af60109268a951cfdc2841dca40c755add994bff880ec34bba832182119c48a2
RedLineStealer
c4be95ed58c7350e35d6348e7f2e73d59c84d525796dbeac67fab6c7070280e4
RedLineStealer
c7839db336f11c965ab8e6fbad1a6c757711a24362cc20d63d4ce37aef9b83b1
RedLineStealer
cf8a60b5e39660a02d37d4d5f1d28e392427c1da05142d4a651cd1c267d07cc1
RedLineStealer
+ 5'373 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/210925-lvjj8sbae6/
Behaviour
Checks SCSI registry key(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Deletes itself
SmokeLoader
Malware Config
C2 Extraction:
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Unpacked files
SH256 hash:
207056003b4b6e55dfe2557a2d1ca119c7785cfe626328a4a8c74323238933e9
MD5 hash:
4955a27a03f35933fdbd801f425b6c58
SHA1 hash:
97f3b8f33fd1a49cf9db5a246d996047beef3c12
Link:
https://www.unpac.me/results/e69ae69b-96f8-4274-97de-1320add86e71/
Parent samples :
db50d646494970b78887d4d84f52147c4cdbaa0b23cb4eb330ffa2403735937c
f1e1b516a83f303659e53d513c9c3da9dfd466f40b96f8de86ca37ce9544d234
d3de52ec5e00eff831e15a2719c702f98fbcf95183849dea98d1483c6f171446
7140765cd0d5f61bb453f0511e24786e21d950c2cb3b30aa2945ba1846a4e0a5
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
93ac84d519edb6350cf53736449330985fe1cb52eff043857daf6cca916d6fa3
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
269d2ae2661789f8929d934a7f7e44b6d6fa2e2fc3799fd53b44988aed906b1f
SH256 hash:
61167f2be099b7bf668e25a470119adfa0c409c2e5c059ad1a016c14dd168f3f
MD5 hash:
8cd6a0f9c54968b2003415a62a6ce8b7
SHA1 hash:
ea5bacbba4ebceacf4f7c547fc840d03fb8654f7
Link:
https://www.unpac.me/results/e69ae69b-96f8-4274-97de-1320add86e71/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/61167f2be099b7bf668e25a470119adfa0c409c2e5c059ad1a016c14dd168f3f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/191492/

Comments