MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ac0bd2fd0b3cc4bef390d3830ebe9d125b99e7f34f63b8db96e5bb40cfbf708. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ac0bd2fd0b3cc4bef390d3830ebe9d125b99e7f34f63b8db96e5bb40cfbf708
SHA3-384 hash: 0e2bd81c1c4ad4d8685b0f5cc40e0cf4c9ae997f5965e49574b44ab5e3717cddd40e5c2a81fd86e1cba8e559ded4a7cb
SHA1 hash: 8133be8e8ff0383b2655014dcd08db475df2cf17
MD5 hash: a59438ede72b2b5723b1508e7f8b7bbc
humanhash: social-ack-arkansas-december
File name:a59438ede72b2b5723b1508e7f8b7bbc.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:164'352 bytes
First seen:2022-03-05 19:25:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5ed2bba8dd6d67921a51920bf446a033 (2 x RedLineStealer)
ssdeep 3072:aZZVgLWTYEyJi9T1Aj3LGVow8dGD8F6fE5wvpJ3:OVgLWcET1w3LGMdGDecvH
Threatray 4'237 similar samples on MalwareBazaar
TLSH T1A9F38D1832F9C072D1AB15764435C3B15E7BB8B61F366D8F7EC52BB90F252E18A2530A
File icon (PE):PE icon
dhash icon d2b1e4d4ecb987f9 (38 x RedLineStealer, 18 x RaccoonStealer, 15 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.215.113.66:26416

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.215.113.66:26416 https://threatfox.abuse.ch/ioc/392582/

Intelligence

File Origin
# of uploads :
1
# of downloads :
295
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/247581/
Detection(s):
Win.Malware.Generic-9937750-0
Create hunting rule

Win.Dropper.Tofsee-9937828-0
Create hunting rule

Win.Dropper.Tofsee-9937829-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Sending a custom TCP request
Sending an HTTP GET request
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/8323/overview
Behaviour
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
EvasionGetTickCount
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d4e801ec-2cfe-4f7b-b5a8-e7166c786681
Result
Threat name:
RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/951255
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to infect the boot sector
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 583736 Sample: x9Fr3pLIaO.exe Startdate: 05/03/2022 Architecture: WINDOWS Score: 100 44 store-images.s-microsoft.com 2->44 54 Multi AV Scanner detection for domain / URL 2->54 56 Found malware configuration 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 8 other signatures 2->60 9 x9Fr3pLIaO.exe 2->9         started        12 ewgjtid 2->12         started        14 7F65.exe 2->14         started        signatures3 process4 signatures5 78 Detected unpacking (changes PE section rights) 9->78 80 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 9->80 82 Maps a DLL or memory area into another process 9->82 84 Creates a thread in another existing process (thread injection) 9->84 16 explorer.exe 4 9->16 injected 86 Multi AV Scanner detection for dropped file 12->86 88 Machine Learning detection for dropped file 12->88 90 Checks if the current machine is a virtual machine (disk enumeration) 12->90 process6 dnsIp7 38 dollybuster.at 211.119.84.112, 49750, 49810, 49814 LGDACOMLGDACOMCorporationKR Korea Republic of 16->38 40 drcopps.com 194.87.107.89, 49753, 80 AS-REGRU Russian Federation 16->40 42 8 other IPs or domains 16->42 30 C:\Users\user\AppData\Roaming\ewgjtid, PE32 16->30 dropped 32 C:\Users\user\AppData\Local\Temp\F283.exe, PE32 16->32 dropped 34 C:\Users\user\AppData\Local\Temp\7F65.exe, PE32 16->34 dropped 36 C:\Users\user\...\ewgjtid:Zone.Identifier, ASCII 16->36 dropped 46 System process connects to network (likely due to code injection or exploit) 16->46 48 Benign windows process drops PE files 16->48 50 Deletes itself after installation 16->50 52 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->52 21 F283.exe 1 16->21         started        24 7F65.exe 16->24         started        file8 signatures9 process10 signatures11 62 Multi AV Scanner detection for dropped file 21->62 64 Writes to foreign memory regions 21->64 66 Allocates memory in foreign processes 21->66 68 Injects a PE file into a foreign processes 21->68 26 AppLaunch.exe 2 21->26         started        28 conhost.exe 21->28         started        70 Detected unpacking (changes PE section rights) 24->70 72 Detected unpacking (overwrites its own PE header) 24->72 74 Machine Learning detection for dropped file 24->74 76 Contains functionality to infect the boot sector 24->76 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ac0bd2fd0b3cc4bef390d3830ebe9d125b99e7f34f63b8db96e5bb40cfbf708/
Threat name:
Win32.Trojan.Raccrypt
Create hunting rule
Status:
Malicious
First seen:
2022-03-04 10:32:33 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
32 of 42 (76.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=plal2l6qwpgex3zzbu4db27j2es3tht7gt3dxdnznzn3idh364ea._file
Verdict:
malicious
Similar samples:
3fdf21f7ad2430c552a8dc34c6fbaf82d95a0f44b9a7bd514d89ad3d074d345f
RedLineStealer
48267b826fa7ec0cea8be878f979a967d0a091cccea9f226ad8d87b29dc94800
RedLineStealer
538d3533398c3f0adbd59483ced973cf35803de5e9356e8dafb5f6bea4049a30
RedLineStealer
55560b608e7a7515329d395c72dc9cebc5cdd7b4c0f153d6e02eb74c2a609feb
RedLineStealer
7b24f14ce1d2cb622d41c4f8b6fe23edb1471ede00b0b0e8c6c37d8379f5f58a
RedLineStealer
9b031ce5a98e281a6c59d198e443653c2c873b416f597e85433754dd962ac816
RedLineStealer
b1516cc28d0e6e3f77a8eadd2a7fda7daf746e0a7b27088e016519baf8de0338
RedLineStealer
+ 4'227 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/220305-x5hw8shah5/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Deletes itself
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
SmokeLoader
Malware Config
C2 Extraction:
http://dollybuster.at/upload/
http://spaldingcompanies.com/upload/
http://remik-franchise.ru/upload/
http://fennsports.com/upload/
http://am1420wbec.com/upload/
http://islamic-city.com/upload/
http://egsagl.com/upload/
http://mordo.ru/upload/
http://piratia-life.ru/upload/
Unpacked files
SH256 hash:
deb096ef5410cfed2d9459b6b28b6dee42d1dee38456cfd77f071fb64b269410
MD5 hash:
4b2fb9ab2cd9c067d0b7550a3be87f4e
SHA1 hash:
919f66f587f82177355c0840aea4a0eb79531aaa
Link:
https://www.unpac.me/results/9c4eaf57-26b2-4a30-9905-93ec3dd5c33d/
SH256 hash:
7ac0bd2fd0b3cc4bef390d3830ebe9d125b99e7f34f63b8db96e5bb40cfbf708
MD5 hash:
a59438ede72b2b5723b1508e7f8b7bbc
SHA1 hash:
8133be8e8ff0383b2655014dcd08db475df2cf17
Link:
https://www.unpac.me/results/9c4eaf57-26b2-4a30-9905-93ec3dd5c33d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7ac0bd2fd0b3cc4bef390d3830ebe9d125b99e7f34f63b8db96e5bb40cfbf708

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/247581/

Comments