MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ecc7de3bd2ed51805c471b6ffe60dd70f4ea1b5fcd0cd0fc2187eb0767fb8e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs 3 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ecc7de3bd2ed51805c471b6ffe60dd70f4ea1b5fcd0cd0fc2187eb0767fb8e0
SHA3-384 hash: d50cd7b81480ca37618e6ecdf9822d8d5e5ee4c3a4a38fe0c7ee4228f2bf95338bcca7d3df34925f873f90645401a896
SHA1 hash: 55a5e7d75cd8d7dc56d398b80faf566bdd28964f
MD5 hash: 55660d41c1b83e5ffff09d8355b55209
humanhash: illinois-sierra-robin-finch
File name:6ECC7DE3BD2ED51805C471B6FFE60DD70F4EA1B5FCD0C.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:272'896 bytes
First seen:2022-03-16 14:05:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d9430a21caf8f698e2680c3051417cb9 (2 x Smoke Loader, 1 x ArkeiStealer, 1 x DanaBot)
ssdeep 1536:AQfhtfRJKo5L/nQmWP4kGizqFfbyJyhsBrkauOCFDnLUa97CyUdahsJs:AQfhNLphiqpOyhCOOCFDLN97zhsi
Threatray 9'836 similar samples on MalwareBazaar
TLSH T11C44AE2D3AB0C432D5A359744874EAF06E3BBC226B76C17B774817EE5F322805A26357
File icon (PE):PE icon
dhash icon fcfcb4f4d4d4d8c8 (8 x RedLineStealer, 6 x RaccoonStealer, 4 x ArkeiStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.150.103.37:21330

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
193.150.103.37:21330 https://threatfox.abuse.ch/ioc/395512/
91.243.32.19:20141 https://threatfox.abuse.ch/ioc/395717/
193.106.191.253:6393 https://threatfox.abuse.ch/ioc/395718/

Intelligence

File Origin
# of uploads :
1
# of downloads :
214
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/251441/
Detection(s):
Win.Dropper.Tofsee-9919472-0
Create hunting rule

Win.Dropper.Lockbit-9919572-0
Create hunting rule

Win.Malware.Stopcrypt-9933337-0
Create hunting rule

Win.Dropper.Tofsee-9934046-0
Create hunting rule

Win.Dropper.Tofsee-9934861-0
Create hunting rule

Win.Dropper.Generickdz-9935256-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/9468/overview
Behaviour
MalwareBazaar
CPUID_Instruction
MeasuringTime
SystemUptime
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/6231eecddfdfa8501ca9f348/reports/7bf6b4e2-77f8-4a8b-80f2-1ac68695f15f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8ea6e09a-6e8d-4cf1-b570-247ec50b6c37
Result
Threat name:
RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/958142
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 590632 Sample: 6ECC7DE3BD2ED51805C471B6FFE... Startdate: 16/03/2022 Architecture: WINDOWS Score: 100 29 recmaster.ru 2->29 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 Antivirus detection for URL or domain 2->49 51 8 other signatures 2->51 8 6ECC7DE3BD2ED51805C471B6FFE60DD70F4EA1B5FCD0C.exe 2->8         started        11 rgigiji 2->11         started        13 rgigiji 2->13         started        signatures3 process4 signatures5 59 Detected unpacking (changes PE section rights) 8->59 61 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 8->61 63 Maps a DLL or memory area into another process 8->63 15 explorer.exe 2 8->15 injected 65 Antivirus detection for dropped file 11->65 67 Multi AV Scanner detection for dropped file 11->67 69 Machine Learning detection for dropped file 11->69 71 Checks if the current machine is a virtual machine (disk enumeration) 13->71 73 Creates a thread in another existing process (thread injection) 13->73 process6 dnsIp7 31 recmaster.ru 58.124.228.242, 49786, 49791, 49792 SKB-ASSKBroadbandCoLtdKR Korea Republic of 15->31 33 193.106.191.67, 44400, 49800, 49814 BOSPOR-ASRU Russian Federation 15->33 35 8 other IPs or domains 15->35 23 C:\Users\user\AppData\Roaming\rgigiji, PE32 15->23 dropped 25 C:\Users\user\AppData\Local\Temp\407B.exe, PE32 15->25 dropped 27 C:\Users\user\...\rgigiji:Zone.Identifier, ASCII 15->27 dropped 37 System process connects to network (likely due to code injection or exploit) 15->37 39 Benign windows process drops PE files 15->39 41 Deletes itself after installation 15->41 43 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->43 20 407B.exe 2 15->20         started        file8 signatures9 process10 signatures11 53 Detected unpacking (changes PE section rights) 20->53 55 Detected unpacking (overwrites its own PE header) 20->55 57 Machine Learning detection for dropped file 20->57
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ecc7de3bd2ed51805c471b6ffe60dd70f4ea1b5fcd0cd0fc2187eb0767fb8e0/
Threat name:
Win32.Trojan.DiskWriter
Create hunting rule
Status:
Malicious
First seen:
2022-01-09 11:24:30 UTC
File Type:
PE (Exe)
Extracted files:
24
AV detection:
39 of 42 (92.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n3gh3y55f3krqboeog3p7zqn24hu5inv7tim2d6cdb7la5t7xdqa._file
Verdict:
malicious
Similar samples:
040cd65e51c5a7de2a9098d4989399ddbbffe7b4c2b5a2f9fe2243d17b2ebe72
RedLineStealer
2988763ce776fb8a9c79a2565384a30744cccd114cde7ee49b71965396f41bc7
RedLineStealer
2d0bd38ea59864cdcd710759abea3f670449eb4505b54c8a8d22128691deefc1
RedLineStealer
4618fb57958c19496e668916d769cb40e6bb0a0af0fbb1ff73ee89e701f3fe9b
RedLineStealer
81158169a9868527feaed169deb8e4cad232e33721a96075797d86fc1a782142
RedLineStealer
e739497b1c69f1e08ba35b2e27c5b60d8205b14a1c7456166c96463fdea6c3aa
RedLineStealer
+ 9'826 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader botnet:ww backdoor discovery infostealer spyware stealer suricata trojan
Link:
https://tria.ge/reports/220316-reeh8scgcr/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
SmokeLoader
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Malware Config
C2 Extraction:
http://nahbleiben.at/upload/
http://noblecreativeaz.com/upload/
http://tvqaq.cn/upload/
http://recmaster.ru/upload/
http://sovels.ru/upload/
193.106.191.67:44400
Unpacked files
SH256 hash:
77dae8bfb2f71eb22292e284468dae35f8a7f0d6bccbb655979839447d13634c
MD5 hash:
89e7d1d102e675ef49f3dbf4040617e7
SHA1 hash:
38e83ba9c7201ea942fd5f6f464d4537007c1cd9
Link:
https://www.unpac.me/results/0ed486e1-1bd5-4bbb-8f51-ae309eead047/
SH256 hash:
6ecc7de3bd2ed51805c471b6ffe60dd70f4ea1b5fcd0cd0fc2187eb0767fb8e0
MD5 hash:
55660d41c1b83e5ffff09d8355b55209
SHA1 hash:
55a5e7d75cd8d7dc56d398b80faf566bdd28964f
Link:
https://www.unpac.me/results/0ed486e1-1bd5-4bbb-8f51-ae309eead047/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/6ecc7de3bd2e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6ecc7de3bd2ed51805c471b6ffe60dd70f4ea1b5fcd0cd0fc2187eb0767fb8e0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/251441/

Comments