MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a345bdaacb572be9699cccdfe7adfbaa1add6f7f4aa2552b8bd91f9c417398e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 13

Intelligence 13 IOCs 1 YARA File information Comments

SHA256 hash:	7a345bdaacb572be9699cccdfe7adfbaa1add6f7f4aa2552b8bd91f9c417398e
SHA3-384 hash:	aafe177509d1a046642375598a6daa9b7c0aca5ba75798b1a2d9099a5a3a648d0e7f4017033ac55221d220262d2e7648
SHA1 hash:	db93765de6e64c6ba81052de8aab04b0847dd969
MD5 hash:	22ccf91eee2c0bd1279b7c4ab0c4ac76
humanhash:	bravo-violet-alpha-arkansas
File name:	22ccf91eee2c0bd1279b7c4ab0c4ac76.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	169'984 bytes
First seen:	2021-12-16 00:21:08 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2bb4e5a139a2a29d6e02a63c04eada73 (2 x RedLineStealer, 1 x ArkeiStealer, 1 x BitRAT)
ssdeep	3072:0sTLWNOKXRXKwG/QpYaD7sbHX+Ika/hsNb:0sTLcRXKwItaMb3LCN
TLSH	T134F39C01B9D2D872C4A60A708860CBE51EBFFC715630455B7BA83BAE6F723C09A75753
File icon (PE):
dhash icon	327a7c7d767e6e76 (4 x RedLineStealer, 1 x ArkeiStealer, 1 x DanaBot)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
45.9.20.168:46257

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
45.9.20.168:46257	https://threatfox.abuse.ch/ioc/276355/

Intelligence

File Origin

# of uploads :

# of downloads :

183

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/214405/

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Searching for synchronization primitives

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/2153/overview

Behaviour

MalwareBazaar

CPUID_Instruction

SystemUptime

MeasuringTime

CheckCmdLine

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/61ba86af45ca64e57f12cfd0/reports/e199a3f6-2942-49cb-a292-906a03fa5d04/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/53734ba4-404d-418c-8757-df27ab3a3594

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/908181

Signature

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7a345bdaacb572be9699cccdfe7adfbaa1add6f7f4aa2552b8bd91f9c417398e/

Threat name:

Win32.Trojan.Midie

Status:

Malicious

First seen:

2021-12-15 16:31:44 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 27 (81.48%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=pi2fxwvmwvzl5fuzztg746w7xkq23vxx6svckuvyxwi7traxhgha._file

Verdict:

malicious

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:redline family:smokeloader botnet:ww backdoor discovery infostealer spyware stealer suricata trojan

Link:

https://tria.ge/reports/211216-anxyhabfgq/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Deletes itself

Reads user/profile data of web browsers

Downloads MZ/PE file

Executes dropped EXE

RedLine

RedLine Payload

SmokeLoader

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Malware Config

C2 Extraction:

http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
45.9.20.168:46257