MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b3804ea5ffe8b354e7e463e2336ce4af8a27eb6bf0c6e64a2f024b9734a463f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs 1 YARA File information Comments

SHA256 hash:	7b3804ea5ffe8b354e7e463e2336ce4af8a27eb6bf0c6e64a2f024b9734a463f
SHA3-384 hash:	8b2b6e56a65be33f7cacdc723654d45d31c8190684293bdb50ac753d2294334bc9f508b43935e926f4c2d9762e2b572d
SHA1 hash:	087115d74598cc4255058ea3966a141b9704f7ac
MD5 hash:	9829a7b1f6d1ef184b90893b8061c9f6
humanhash:	potato-tango-comet-mobile
File name:	9829a7b1f6d1ef184b90893b8061c9f6.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	332'288 bytes
First seen:	2021-12-20 11:06:52 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	bd7fa0e3fdd5520a4b66dc909d923c10 (4 x RedLineStealer, 2 x Amadey, 2 x ArkeiStealer)
ssdeep	6144:jiYY3YqvMGt94HzZ1EzITNUk3GKT5ykSN:+FSGt94HzZ16ITNZGKT5kN
Threatray	6'047 similar samples on MalwareBazaar
TLSH	T158648D007690C435F5B357F85AB99379A92F7EE1AB2490CF12D52AEE56346E0EC3031B
File icon (PE):
dhash icon	25ec1370319b9b91 (13 x RedLineStealer, 13 x Smoke Loader, 6 x Amadey)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
62.182.156.187:56323

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
62.182.156.187:56323	https://threatfox.abuse.ch/ioc/277871/

Intelligence

File Origin

# of uploads :

# of downloads :

161

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/215444/

Detection(s):

Win.Malware.Sabsik-9916500-0

Win.Malware.Sabsik-9916837-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Sending a custom TCP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Sending an HTTP GET request

Creating a file in the %temp% directory

Launching the Android Debug Bridge process

Creating a process from a recently created file

Searching for synchronization primitives

Running batch commands

Creating a process with a hidden window

Changing a file

Creating a file in the %AppData% subdirectories

Launching a process

Unauthorized injection to a recently created process

Query of malicious DNS domain

Unauthorized injection to a recently created process by context flags manipulation

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Sending an HTTP GET request to an infection source

Unauthorized injection to a system process

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/2741/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

EvasionGetTickCount

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/61c063d8ec6c6c14a9e4da14/reports/d3fe7fd6-ace5-487e-8015-ecb6874920df/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8507d308-3737-4c17-92ad-33d6f763f342

Result

Threat name:

Djvu SmokeLoader Vidar

Detection:

malicious

Classification:

rans.troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/910210

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Djvu Ransomware

Yara detected SmokeLoader

Yara detected Vidar

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7b3804ea5ffe8b354e7e463e2336ce4af8a27eb6bf0c6e64a2f024b9734a463f/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2021-12-20 11:18:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pm4aj2s772ftktt6iy7cgnwojl4ke7vwx4gg4zfc6asls42kiy7q._file

Verdict:

malicious

RedLineStealer

664543a2800a9d4d0ebae4f742350251bb0df2a447a302032c1fe22c7c1e7398

RedLineStealer

87ca287a00652e31d4d8c5d9f329972103c5a14a55ff5f7a87c130f458fa7268

RedLineStealer

8b2d28cadf36d5fc43cc753d1988a749f8abc57e2858c7367b9b20ef0269d045

RedLineStealer

a060a74782c89d4b4c29d8d4e7fd3daa42bc8c82baa09a981690acef34fe6810

RedLineStealer

a8e9862a60fed2c39dac54eff834ba842a6f3dbbea116f622b5ad15214f316b9

RedLineStealer

bb509493c43cee14ef829cd39023da5bc91af35e44d705800de5e7a2c9e2f514

RedLineStealer

ca6f0fad6894549a79754b9270cd58c91cc83ad78ed67acdb4c26b023a091e9f

RedLineStealer

fdebda5876b7ca1c4cdad1a4eb3681260a4f9fa38f0bdbe7c3731501dc482ae0

RedLineStealer

+ 6'037 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:amadey family:arkei family:redline family:smokeloader family:tofsee family:xmrig botnet:1 botnet:444 botnet:install backdoor collection discovery evasion infostealer miner persistence spyware stealer suricata trojan vmprotect

Link:

https://tria.ge/reports/211220-m7zyesbbep/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Creates scheduled task(s)

Delays execution with timeout.exe

GoLang User-Agent

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Launches sc.exe

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

VMProtect packed file

Arkei Stealer Payload

XMRig Miner Payload

Amadey

Arkei

RedLine

RedLine Payload

SmokeLoader

Tofsee

Windows security bypass

suricata: ET MALWARE Amadey CnC Check-In

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

xmrig

Malware Config

C2 Extraction:

http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
mubrikych.top
oxxyfix.xyz
185.215.113.35/d2VxjasuwS/index.php
62.182.156.187:56323
86.107.197.138:38133
31.131.254.105:1498