MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 70e14ddf23a5fe3d69cc50752fcc491aa2964a2cfee3d48caf182244929f9953. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 12
| SHA256 hash: | 70e14ddf23a5fe3d69cc50752fcc491aa2964a2cfee3d48caf182244929f9953 |
|---|---|
| SHA3-384 hash: | 1137a862deca59ddb1f988a66709067fa171735e5b15cdec58ccb1934888800a01fbc7299077583ddfabc935b6c4fdb9 |
| SHA1 hash: | eb6bc44515419244e194d1b2694aca570ba91f7a |
| MD5 hash: | b6038cccff037514a3cd3a2346abaa27 |
| humanhash: | fish-december-blossom-black |
| File name: | 70E14DDF23A5FE3D69CC50752FCC491AA2964A2CFEE3D.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 6'244'367 bytes |
| First seen: | 2022-01-25 06:56:26 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | c05041e01f84e1ccca9c4451f3b6a383 (142 x RedLineStealer, 109 x GuLoader, 64 x DiamondFox) |
| ssdeep | 98304:JTj+ANs9gNMeWyQqALueTOdGCD5XRPRXgjuQ+Y7UI6vUq8/41ErlR6eQ8V2oEw1k:J3Zs9OPCTOdNDbpQ+Y7U1Uqw41EjzQgC |
| Threatray | 1'055 similar samples on MalwareBazaar |
| TLSH | T17356338490CE9F42FF8FC63151B252F34D6BA1FE25AB561A03126E217948F4E9E3DD18 |
| File icon (PE): |  |
| dhash icon | b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla) |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 91.243.59.167:44301 | https://threatfox.abuse.ch/ioc/323383/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DLInjector04
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
Searching for the window
Running batch commands
Sending a custom TCP request
DNS request
Searching for synchronization primitives
Launching a process
Launching the default Windows debugger (dwwin.exe)
Creating a process with a hidden window
Creating a window
Unauthorized injection to a recently created process
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
arkeistealer barys control.exe mokes overlay packed shell32.dll
Malware family:
Bsymem
Verdict:
Malicious
Result
Threat name:
Socelars onlyLogger
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates HTML files with .exe extension (expired dropper behavior)
Disable Windows Defender real time protection (registry)
Disables Windows Defender (via service or powershell)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious MSHTA Process Patterns
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Windows Shell File Write to Suspicious Folder
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Writes many files with high entropy
Yara detected onlyLogger
Yara detected Socelars
Yara Genericmalware
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Fabookie
Status:
Malicious
First seen:
2021-10-28 20:21:28 UTC
File Type:
PE (Exe)
Extracted files:
203
AV detection:
32 of 43 (74.42%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
raccoon
Similar samples:
+ 1'045 additional samples on MalwareBazaar
Result
Malware family:
socelars
Score:
10/10
Tags:
family:redline family:socelars botnet:chris botnet:media26 botnet:sert23 aspackv2 evasion infostealer spyware stealer trojan
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious behavior: EnumeratesProcesses
Script User-Agent
Modifies system certificate store
Modifies registry class
Modifies data under HKEY_USERS
Kills process with taskkill
Checks processor information in registry
Checks SCSI registry key(s)
Program crash
Enumerates physical storage devices
Suspicious use of SetThreadContext
Drops file in System32 directory
Looks up geolocation information via web service
Looks up external IP address via web service
Legitimate hosting services abused for malware hosting/C2
Reads user/profile data of web browsers
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Downloads MZ/PE file
ASPack v2.12-2.42
Suspicious use of NtCreateUserProcessOtherParentProcess
Socelars Payload
Socelars
RedLine Payload
RedLine
Process spawned unexpected child process
Modifies Windows Defender Real-time Protection settings
Malware Config
C2 Extraction:
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
194.104.136.5:46013
135.181.129.119:4805
91.121.67.60:23325
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
194.104.136.5:46013
135.181.129.119:4805
91.121.67.60:23325
Unpacked files
SH256 hash:
e297e89e11933aa6fc67cbd8da44fc0f6b8d8030166738b111b31673d41e4d19
MD5 hash:
2a2667d1fbcd8fde9ca0bd6f50827c79
SHA1 hash:
f6838f02651e1430613bf78de99e240dbcb8d3c7
SH256 hash:
6525d30654a1a8255ac9a366035d841b991648e442f3a802f919726d604e9ce4
MD5 hash:
799f15cb784fe1bd6922939d46426c20
SHA1 hash:
43cc59cf651dca1208271ab740a7820054df8ba0
SH256 hash:
0cddd277bd0f1f5510538c0bd9b1cff4c5cd01c5caee8eb9d06b9baa88519052
MD5 hash:
6449aa2e023c5931ac91815ca54225ed
SHA1 hash:
65b5f4df2c28472469ddf924e6b0d0a61394c612
SH256 hash:
ea788a6785b36f87f7214922e32445990af0aa7ad14152f849353b52096a52b5
MD5 hash:
fbab7f0afd2d15481e1efbda54aa5ead
SHA1 hash:
18bdb59577d400786a27090d1e8b52a2fffd6f3b
SH256 hash:
2c964c5070502f6000bbb3f66f200a18ac7c394c5d6764c1d1f726783959d40a
MD5 hash:
5b68c333ae0c1d013619eda08f6665db
SHA1 hash:
d616077f94916d44662b6c6bf19b177e32454559
SH256 hash:
82b60a8c25db65bae520e73b7a67d2a6ca1f0fe6926439d0d7f1c0d52aa2f7d4
MD5 hash:
a758705ffd480485776c573bbe7091ca
SHA1 hash:
ae62bd009da6c2bf8e91f06a9a01890f74828d07
SH256 hash:
8ce61c25d6a977e4bd80e9c5598ab62fc64cf18498b8cc0613029c33012c9c74
MD5 hash:
cd320dca08282615d1d24758f0cb7738
SHA1 hash:
ad8ee19ddc9c8fa39e1dd0e44974bb6db4c5abf6
SH256 hash:
bbd237743cb43b0e6313fc0583df78e349363c2a9e7b093e2252c465e10ceb67
MD5 hash:
f9213bc004717003518130d5626e06cd
SHA1 hash:
ad1b87ac5e72657baf2c22f32f62459832693ed5
SH256 hash:
4a3474de044cf14b3641e2eccefab798b24ef8e4f074186a2278cb3f9c5ff7b8
MD5 hash:
7836c66d73a8df0f02d303ff8a13e86a
SHA1 hash:
a9ebc0e5e08970441f5a6bcd35b3d810e764ef18
SH256 hash:
b5d20c8d3148e88fbbb68d6f3002057a62244e5938881b2e0a90f7ba5d54ef4e
MD5 hash:
d51d8a61eda3587fe660ac76ff583577
SHA1 hash:
81ae703c2a1e8633c30afa1f09298901de4cd1d0
SH256 hash:
952dc3d4b3cc35e331083e47c731b941ee8e880927f6248b54cf0d3868f45238
MD5 hash:
f917278e55b942d9354c79dec2f94389
SHA1 hash:
7e01f0ad2aba7241af7427123fb35fedc89dbb24
SH256 hash:
f8b7bbc0d80057665fe669ee6314a671ea3979c5afcf2bbc4652af4abb2c620e
MD5 hash:
f3736b57857706efec6082d257f463a3
SHA1 hash:
540da2b1922879d71f97ca523375b9b4802b2efc
SH256 hash:
0ed832669626fed02895c5a5bbaecdf3d7bb94ed504add0cfef367e068e76b51
MD5 hash:
f79c4f92f0392b9013302aa667df0139
SHA1 hash:
3e3fafbf1dca5aa940d06eef01a1550e5fc7cc82
SH256 hash:
e8727c5e9114f3234d77075effca68c32072c6cb18377762da8c7c5c4bc7b650
MD5 hash:
769483334615f2ad86cbc8d4490fe1bf
SHA1 hash:
24153cc67f9ee102e63caa1877cc9ef3075b5363
SH256 hash:
1c9eacbb6f314228d66c4ac6101879294025fb179067ae9ff1fa4bbcb45371db
MD5 hash:
6bf50c81d64b7b392945786efb092580
SHA1 hash:
23c42a399c7433aba20b9f2b96f5b3c3a340955e
SH256 hash:
e1cc6a9d780602fe6e789bf5c3a27e87e197a4e3bf7c8138ea2f9dfec70fb963
MD5 hash:
f707252b9c9579677fffb013e0cfc646
SHA1 hash:
8ab483023fa8773afb8c13464c39c5b8e687f126
SH256 hash:
14ac25cea65bf076c28fccb5d9f5a01e656ae4404db456d6d4e3dd2deb03ccf1
MD5 hash:
d3d2841f74d5ede7a98658e2be89e8b0
SHA1 hash:
3cc65a7f014cb041ab21f5854cfd39bd3bc1b82f
SH256 hash:
7ad9edd79f03fb782d1a8490f9b56ea25f8e9cd33f10ca5017f8ff5aac6b5eda
MD5 hash:
1ee5fb8981ebc7fb9ddacb9d8607d35c
SHA1 hash:
eefc86ed0839384d351d7229fea251714a5cae1e
SH256 hash:
4887918b59cd66475a12a9c512ec570e6f900c23ef69ff7513e2b5cd63fd2ef2
MD5 hash:
4d3446a7e14d3250e1030b67e202c8dd
SHA1 hash:
cd8fdfdfed34fcd05700293658bfcf8528e68802
SH256 hash:
ce7e030f2bb5f0f236c130f48b2c98db580b26c86aac00b0d568b39c5e0fd3a8
MD5 hash:
47e29ee3fb7e8d10c2703e1992c55330
SHA1 hash:
9ffa449c95eee01a4cc96010f6f7992e3f3f572b
SH256 hash:
d0089354209717bcbd4e4260c2002b341b15696f2774be9155e6073a7c38f82c
MD5 hash:
d6465eaf0f5ffdaeee8d3bf6d6386f66
SHA1 hash:
f05bea1eebbdb18ff29dc80b4f666f3d7ac9dfc4
SH256 hash:
1d318ea6b0e53056e4c52edb30773e1891ef4a583b72416017916c835f34c63b
MD5 hash:
29fd55ab0f7c73fe47ababae0768d768
SHA1 hash:
681f6ed191b7ea199ff0613a1d0dace62d507272
SH256 hash:
72a1ff1cc48ce5e0b5847ba4346e4cf9c6e6872ff722759671c5364a6aebda4f
MD5 hash:
c5331385632913db75c999626e9658fb
SHA1 hash:
652637551472ef8b12087c855de28dd147fec9f7
SH256 hash:
8257634b50be87e33c0260d5248c8402b15455c18835f2e155c99adc2fc3fecd
MD5 hash:
4dcd9bfc822342ca76b6729b73c1add0
SHA1 hash:
94abf2d8a562d1f9babf2d5eba8e4e121be8c4ae
SH256 hash:
70e14ddf23a5fe3d69cc50752fcc491aa2964a2cfee3d48caf182244929f9953
MD5 hash:
b6038cccff037514a3cd3a2346abaa27
SHA1 hash:
eb6bc44515419244e194d1b2694aca570ba91f7a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.