MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 682e376143a80eb59d7a3944619d4c2119e88e828b8bc8dd555ba73835c961ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


N-W0rm


Vendor detections: 13


Intelligence 13 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 682e376143a80eb59d7a3944619d4c2119e88e828b8bc8dd555ba73835c961ec
SHA3-384 hash: ec115f1a25cd7f5b1e3e52332ec7924c6ab2bef41de643829844946381b92bb2198ff9ea5af2773037a5b21e59f62aa7
SHA1 hash: 6cd734b1367489188094d0d4ca185e7623b733d8
MD5 hash: 3a11fb4545c1033ef3f00bafdb4a66b5
humanhash: equal-asparagus-uranus-timing
File name:file
Download: download sample
Signature N-W0rm
Create hunting rule
File size:5'242'192 bytes
First seen:2022-08-26 10:09:11 UTC
Last seen:2022-09-02 11:45:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 172750858dcc0719eed08c952858023c (117 x RedLineStealer, 3 x N-W0rm, 1 x AsyncRAT)
ssdeep 98304:OPx2NItkXW9aJeA2tVypETPsrhc/vmdq3/PV2rrtZO6r9ZB7YgZ:O9kuA2DypETEtivmEcnF
TLSH T18B36123361646155D1F888398737FFE432F916328B81E8B675EA99C727364D1B223B83
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.5% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon cc8e396b29638ecc (1 x PrivateLoader, 1 x N-W0rm)
Reporter andretavare5
Tags:exe N-W0rm signed

Code Signing Certificate

Organisation:jbl Słuchawki nauszne JBL Studio 900 Biały
Issuer:jbl Słuchawki nauszne JBL Studio 900 Biały
Algorithm:sha1WithRSAEncryption
Valid from:2022-08-25T11:43:31Z
Valid to:2032-08-26T11:43:31Z
Serial number: 37c4cc7ade08b8944a54015cc6126b54
Intelligence: 7 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 5ef9859bcf2326e9c62283d5860dec8d7a6c07e8502f368760daa1475f54d223
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from https://vk.com/doc572676066_643388486?hash=1QMpWgdtPuY7P3kkNwqf7EzzTq8UU1TQeOG3Tzw66mg&dl=GU3TENRXGYYDMNQ:1661508482:vRcSaAMmtB3GpCWYnGK5bX3yIEQKwGFM8yj1tdQAZ18&api=1&no_preview=1#v26080

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
167.235.239.121:81 https://threatfox.abuse.ch/ioc/845610/

Intelligence

File Origin
# of uploads :
6
# of downloads :
390
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-08-26 10:09:56 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/28209dae-06f8-4c00-8a24-b1910adf5e78

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/301376/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.21547.16267.28066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Creating a file in the system32 subdirectories
Creating a file
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Query of malicious DNS domain
Sending a TCP request to an infection source
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm overlay packed
Link:
https://www.filescan.io/uploads/63089c00393b1c8c47151765/reports/2ed6a9d8-5cd4-4559-b5a0-80cfdd3276f0/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f962f8b0-f8ce-4c27-8acd-985a540913c4
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1058310
Signature
Found many strings related to Crypto-Wallets (likely being stolen)
Malicious sample detected (through community Yara rule)
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Generic Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/682e376143a80eb59d7a3944619d4c2119e88e828b8bc8dd555ba73835c961ec/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-08-26 10:10:13 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=naxdoykdvahllhl2hfcgdhkmeem6rducrof4rxkvlottqnojmhwa._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/220826-l7cx8abhd7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Unpacked files
SH256 hash:
c57a405580164d6f74e7d16e1923b96b8cf286734f87a28a87bc3fb3149daca6
MD5 hash:
97299d16122042c6f13314a4760c8637
SHA1 hash:
919b2f9e2350f2f83d619936fba5479fc56dbafa
Link:
https://www.unpac.me/results/3e42c297-57bf-4c23-a56a-562b928aed78/
SH256 hash:
41cc650065b531421da32ec0176604bc71f0674cd40fc9e3e1cc7e4ff2b955d3
MD5 hash:
388a1b8431b0c9b84e59b89730cc17fd
SHA1 hash:
143cff932c62de4436999952b3a7fad1595279ac
Link:
https://www.unpac.me/results/3e42c297-57bf-4c23-a56a-562b928aed78/
SH256 hash:
682e376143a80eb59d7a3944619d4c2119e88e828b8bc8dd555ba73835c961ec
MD5 hash:
3a11fb4545c1033ef3f00bafdb4a66b5
SHA1 hash:
6cd734b1367489188094d0d4ca185e7623b733d8
Link:
https://www.unpac.me/results/3e42c297-57bf-4c23-a56a-562b928aed78/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/682e376143a8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/682e376143a80eb59d7a3944619d4c2119e88e828b8bc8dd555ba73835c961ec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/301376/
  
URLhaus
https://urlhaus.abuse.ch/url/2279414/

Comments