MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6556b141cb6d777870608bcdcccf2851e4707edccbe14793bdc81b01f5d0819d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs 1 YARA File information Comments

SHA256 hash:	6556b141cb6d777870608bcdcccf2851e4707edccbe14793bdc81b01f5d0819d
SHA3-384 hash:	6cb9a162abf772efa27c09e0520ee8d7ac2eb6f71f19757e1102ab92ee316f289203ddbab4f62f3eab356202bb73674c
SHA1 hash:	7b0ea7a291774a35fa40f5ce56e8475b3f8576f8
MD5 hash:	16350cba7be7cd1f3bf3552ea2e0ef3d
humanhash:	jig-connecticut-six-green
File name:	16350cba7be7cd1f3bf3552ea2e0ef3d.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	288'768 bytes
First seen:	2022-04-06 13:31:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2ae2b02f1c6c07ced2174fa032cff5a3 (4 x Stop, 1 x RedLineStealer)
ssdeep	6144:wKHGM/C5bxRpNu/eb7XOG0y7ITsqdiga:wKHGM/C5ljU/Kcy7j
Threatray	12'986 similar samples on MalwareBazaar
TLSH	T16E54AEC172928471C0662E30A826FBA1253B7C31E6705457FFB86B2F2E703D15AE675E
File icon (PE):
dhash icon	fcfcb4b4b4d4d9c1 (24 x RedLineStealer, 10 x Smoke Loader, 4 x RaccoonStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
5.45.77.29:41494

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
5.45.77.29:41494	https://threatfox.abuse.ch/ioc/516066/

Intelligence

File Origin

# of uploads :

# of downloads :

251

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/261283/

Detection(s):

Win.Dropper.Raccoon-9916366-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Searching for synchronization primitives

Sending a custom TCP request

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/12841/overview

Behaviour

SystemUptime

MeasuringTime

EvasionQueryPerformanceCounter

CheckCmdLine

EvasionGetTickCount

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware raccoon

Link:

https://www.filescan.io/uploads/624d965640ce5db9f41b6d23/reports/d00cb4a4-7d5f-4af0-a7ea-aeedeae06703/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8a407bcc-bc6f-4a43-b471-30330e712391

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/971522

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6556b141cb6d777870608bcdcccf2851e4707edccbe14793bdc81b01f5d0819d/

Threat name:

Win32.Backdoor.Mokes

Status:

Malicious

First seen:

2022-04-06 13:22:17 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mvllcqolnv3xq4darpg4ztzikhsha7w4zpqupe55zanqd5oqqgoq._file

Verdict:

malicious

RedLineStealer

313c8bb887567806112d0755963632c1b6f66d9479965efae7ce39cd4738bc1a

RedLineStealer

687ca5a69fc193e08538b21f8b0aba4a279c75561873b45e71e3ce57721c815b

RedLineStealer

93fc4f2ee5e58547ba2073c5475e846a13f9e98209732bd160f9f5b355b41bca

RedLineStealer

a37cbddb545f168aa1dbb09433e228e5a956f6d8fbc00fae892a5f047990a71f

RedLineStealer

a63dbe18cf6ff766405f06066655fca8fcdf2bfe2a0147006d3d29ef00734fc4

RedLineStealer

ebf3a044246492128aa29dad0c4802f374fe32efb8179da5b9f284dc7e3579a4

RedLineStealer

+ 12'976 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:arkei family:smokeloader botnet:default backdoor discovery evasion spyware stealer suricata trojan

Link:

https://tria.ge/reports/220406-qsyctsgcbn/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Checks BIOS information in registry

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Executes dropped EXE

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Arkei

SmokeLoader

suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

suricata: ET MALWARE Generic gate .php GET with minimal headers

suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

Malware Config

C2 Extraction:

http://coralee.at/upload/
http://ducvietcao.com/upload/
http://biz-acc.ru/upload/
http://toimap.com/upload/
http://bbb7d.com/upload/
http://piratia-life.ru/upload/
http://curvreport.com/upload/
http://viagratos.com/upload/
http://mordo.ru/upload/
http://pkodev.net/upload/
http://193.106.191.172/gate.php