MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 749d18c406000741093862157c6da3dbb305efb279fb45f20a981edb7de6287f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 749d18c406000741093862157c6da3dbb305efb279fb45f20a981edb7de6287f
SHA3-384 hash: beebe0844cad777130f857a62e7cb2bf9eb30a0b5f53b35112963d72d0f653672368567af2a2e054e9644c059e4e39fb
SHA1 hash: 876200cd920c7f3fe92ac3ca4e25b98852dbf818
MD5 hash: 15551921baa5b3be25d7629558e253ca
humanhash: lake-dakota-thirteen-nine
File name:15551921baa5b3be25d7629558e253ca.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:457'216 bytes
First seen:2022-10-12 16:55:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 431995fc4e1c6b7aa6a3a333f4d305c5 (12 x Smoke Loader, 4 x RedLineStealer, 1 x TeamBot)
ssdeep 6144:1Sy+gv0rlnrmeYLl4zDk9o6KiAl4uZrActXhhhVY4QcIqs9S7teigavwVf:1WgMhnre4/k9ZKtlKKXhPFQlvwtT
TLSH T144A4E0307692C8B2C0552D30CC15DFA067FFE92169B49A13F768AB6E5E73380566631F
TrID 39.4% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
29.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 38b078eccacccc43 (88 x Smoke Loader, 38 x Stop, 33 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/319474/
Detection(s):
Win.Malware.Azorult-9949206-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Searching for synchronization primitives
Reading critical registry keys
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6346f1a65cada2cbc6ebc5c7/reports/4238f15f-f148-4b39-a384-fb0413f5b32b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/2ef7ac23-d0e7-4ca2-a5a9-3e0afcb15733
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1089006
Signature
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 721604 Sample: dz0wzKoLP4.exe Startdate: 12/10/2022 Architecture: WINDOWS Score: 100 44 Snort IDS alert for network traffic 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 Yara detected SmokeLoader 2->48 50 3 other signatures 2->50 7 dz0wzKoLP4.exe 2->7         started        10 wbihgiv 2->10         started        process3 signatures4 52 Detected unpacking (changes PE section rights) 7->52 54 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 7->54 56 Maps a DLL or memory area into another process 7->56 12 explorer.exe 5 7->12 injected 58 Machine Learning detection for dropped file 10->58 60 Checks if the current machine is a virtual machine (disk enumeration) 10->60 62 Creates a thread in another existing process (thread injection) 10->62 process5 dnsIp6 32 panelis.net 91.213.50.71, 49685, 80 ASBAXETNRU unknown 12->32 34 tournews.online 31.31.198.23, 49686, 80 AS-REGRU Russian Federation 12->34 26 C:\Users\user\AppData\Roaming\wbihgiv, PE32 12->26 dropped 28 C:\Users\user\AppData\Local\Temp\9199.exe, PE32 12->28 dropped 30 C:\Users\user\...\wbihgiv:Zone.Identifier, ASCII 12->30 dropped 64 System process connects to network (likely due to code injection or exploit) 12->64 66 Benign windows process drops PE files 12->66 68 Injects code into the Windows Explorer (explorer.exe) 12->68 70 3 other signatures 12->70 17 9199.exe 12->17         started        20 explorer.exe 12->20         started        22 explorer.exe 12->22         started        24 2 other processes 12->24 file7 signatures8 process9 signatures10 36 Detected unpacking (changes PE section rights) 17->36 38 Machine Learning detection for dropped file 17->38 40 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 17->40 42 3 other signatures 17->42
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/749d18c406000741093862157c6da3dbb305efb279fb45f20a981edb7de6287f/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-10-12 16:56:10 UTC
File Type:
PE (Exe)
Extracted files:
62
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=osorrragaaduccjymikxy3nd3ozql35sph5ul4qktapnw7pgfb7q._file
Verdict:
malicious
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/221012-vfnp3scddl/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Downloads MZ/PE file
Executes dropped EXE
Detects Smokeloader packer
SmokeLoader
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ca1ac4f2-8087-421f-a877-1cc79adbb532
Unpacked files
SH256 hash:
e5c8ddbc26c9711f2313014dab028b1d7dbfcfb595a621db7b4b63e86d059b57
MD5 hash:
463d9ffba473c2848c28064af0d8f884
SHA1 hash:
e8c627de0afb29a441da4850ee783c5ea0c5a17c
Detections:
win_smokeloader_a2
Create hunting rule
SmokeLoaderStage2
Create hunting rule
Link:
https://www.unpac.me/results/b402b2b7-3df7-455e-ac20-94604a3b425c/
SH256 hash:
749d18c406000741093862157c6da3dbb305efb279fb45f20a981edb7de6287f
MD5 hash:
15551921baa5b3be25d7629558e253ca
SHA1 hash:
876200cd920c7f3fe92ac3ca4e25b98852dbf818
Link:
https://www.unpac.me/results/b402b2b7-3df7-455e-ac20-94604a3b425c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/749d18c406000741093862157c6da3dbb305efb279fb45f20a981edb7de6287f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 749d18c406000741093862157c6da3dbb305efb279fb45f20a981edb7de6287f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2365952/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/319474/

Comments