MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ea766da00634b64fd5178410bef330b4fd33aa18c78e09ed0a97c9a8efea116. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs 2 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ea766da00634b64fd5178410bef330b4fd33aa18c78e09ed0a97c9a8efea116
SHA3-384 hash: 626260f87d4295fc460b1265414392ed4755ec9de29cdb3578d570ed08aa72f17440966dc405741f8faec91ad983933b
SHA1 hash: 3661ad4b8f5cdbbf7b5cf81b0f90f5cd12f6e724
MD5 hash: 674666a8bba0a384c1911750f31481db
humanhash: cold-floor-mississippi-hamper
File name:674666a8bba0a384c1911750f31481db.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:300'544 bytes
First seen:2021-11-26 08:50:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ef656273bfb85d28a2059cd3657b6b5f (2 x RaccoonStealer, 2 x RedLineStealer, 1 x Tofsee)
ssdeep 6144:aZFZUPapb6gR0Q2ww4SXuZet0yy8uo7sBJSFvNJ:afq46gOQ254SXuZet0yy8uvSFX
Threatray 6'521 similar samples on MalwareBazaar
TLSH T15D547E107BE0C435F5B75AB889B593A9A93FBDA1AB3890CF62D526DE46346D0DC30307
File icon (PE):PE icon
dhash icon 62e8e8e8aa66a499 (4 x Smoke Loader, 3 x RaccoonStealer, 1 x CryptBot)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
95.181.152.177:21142

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
95.181.152.177:21142 https://threatfox.abuse.ch/ioc/254437/
http://5.181.156.242/ https://threatfox.abuse.ch/ioc/254438/

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
674666a8bba0a384c1911750f31481db.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-26 08:54:12 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d977cef5-52bc-46ab-9c53-6faabe5353c4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Searching for synchronization primitives
DNS request
Sending a custom TCP request
Reading critical registry keys
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Sending an HTTP POST request
Launching a process
Query of malicious DNS domain
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware mokes packed
Link:
https://www.filescan.io/uploads/61a09ff8f36138de3f3e88e9/reports/e6e721c3-4f61-4ab9-9fcf-0568989f3d15/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d530831f-bcc3-4278-9f87-00f254a51a00
Result
Threat name:
Djvu RedLine SmokeLoader Tofsee Vidar
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/896545
Signature
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious MSHTA Process Patterns
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected Djvu Ransomware
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 529023 Sample: oeLqOWnAsl.exe Startdate: 26/11/2021 Architecture: WINDOWS Score: 100 97 xacokuo80.top 2->97 99 quadoil.ru 2->99 101 3 other IPs or domains 2->101 149 Multi AV Scanner detection for domain / URL 2->149 151 Antivirus detection for URL or domain 2->151 153 Antivirus detection for dropped file 2->153 155 19 other signatures 2->155 11 oeLqOWnAsl.exe 2->11         started        13 disiwb.exe 2->13         started        16 wwgvijj 2->16         started        18 eggvijj 2->18         started        signatures3 process4 signatures5 20 oeLqOWnAsl.exe 11->20         started        177 Detected unpacking (changes PE section rights) 13->177 179 Detected unpacking (overwrites its own PE header) 13->179 181 Writes to foreign memory regions 13->181 183 Allocates memory in foreign processes 13->183 23 svchost.exe 13->23         started        185 Machine Learning detection for dropped file 16->185 187 Maps a DLL or memory area into another process 16->187 189 Checks if the current machine is a virtual machine (disk enumeration) 16->189 191 Creates a thread in another existing process (thread injection) 16->191 193 Contains functionality to inject code into remote processes 18->193 195 Injects a PE file into a foreign processes 18->195 26 eggvijj 18->26         started        process6 dnsIp7 157 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 20->157 159 Maps a DLL or memory area into another process 20->159 161 Checks if the current machine is a virtual machine (disk enumeration) 20->161 163 Creates a thread in another existing process (thread injection) 20->163 28 explorer.exe 12 20->28 injected 107 quadoil.ru 85.143.175.153, 443, 49803, 49872 TRADERSOFTRU Russian Federation 23->107 109 microsoft-com.mail.protection.outlook.com 40.93.207.1, 25, 49798 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 23->109 165 System process connects to network (likely due to code injection or exploit) 23->165 signatures8 process9 dnsIp10 117 185.233.81.115, 443, 49802 SUPERSERVERSDATACENTERRU Russian Federation 28->117 119 192.162.246.70, 49776, 80 DATACHEAP-LLC-ASRU Russian Federation 28->119 121 12 other IPs or domains 28->121 89 C:\Users\user\AppData\Roaming\wwgvijj, PE32 28->89 dropped 91 C:\Users\user\AppData\Roaming\eggvijj, PE32 28->91 dropped 93 C:\Users\user\AppData\Local\TempC5B.exe, PE32 28->93 dropped 95 10 other files (9 malicious) 28->95 dropped 197 System process connects to network (likely due to code injection or exploit) 28->197 199 Benign windows process drops PE files 28->199 201 Deletes itself after installation 28->201 203 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->203 33 2F63.exe 2 28->33         started        37 2987.exe 2 28->37         started        39 39F3.exe 5 28->39         started        42 4 other processes 28->42 file11 signatures12 process13 dnsIp14 75 C:\Users\user\AppData\Local\Temp\disiwb.exe, PE32 33->75 dropped 123 Detected unpacking (changes PE section rights) 33->123 125 Detected unpacking (overwrites its own PE header) 33->125 127 Machine Learning detection for dropped file 33->127 143 2 other signatures 33->143 44 cmd.exe 1 33->44         started        47 cmd.exe 2 33->47         started        49 sc.exe 1 33->49         started        61 3 other processes 33->61 129 Antivirus detection for dropped file 37->129 131 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 37->131 133 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 37->133 135 Injects a PE file into a foreign processes 37->135 51 2987.exe 37->51         started        55 conhost.exe 37->55         started        111 45.9.20.149, 10844, 49819 DEDIPATH-LLCUS Russian Federation 39->111 145 2 other signatures 39->145 113 mstdn.social 116.202.14.219, 443, 49879 HETZNER-ASDE Germany 42->113 115 159.69.92.223, 49880, 80 HETZNER-ASDE Germany 42->115 77 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 42->77 dropped 79 C:\Users\user\AppData\...\vcruntime140[1].dll, PE32 42->79 dropped 81 C:\Users\user\AppData\...\mozglue[1].dll, PE32 42->81 dropped 83 9 other files (none is malicious) 42->83 dropped 137 Tries to harvest and steal browser information (history, passwords, etc) 42->137 139 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 42->139 141 Maps a DLL or memory area into another process 42->141 147 2 other signatures 42->147 57 2446.exe 42->57         started        59 99C4.exe 42->59         started        file15 signatures16 process17 dnsIp18 85 C:\Windows\SysWOW64\...\disiwb.exe (copy), PE32 44->85 dropped 63 conhost.exe 44->63         started        65 conhost.exe 47->65         started        67 conhost.exe 49->67         started        103 185.159.80.90, 38655, 49846 HOSTING-SOLUTIONSUS Netherlands 51->103 167 Tries to harvest and steal browser information (history, passwords, etc) 51->167 169 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 57->169 171 Maps a DLL or memory area into another process 57->171 173 Checks if the current machine is a virtual machine (disk enumeration) 57->173 175 Creates a thread in another existing process (thread injection) 57->175 105 api.2ip.ua 77.123.139.190, 443, 49881, 49893 VOLIA-ASUA Ukraine 59->105 87 C:\Users\user\AppData\Local\...\99C4.exe, PE32 59->87 dropped 69 conhost.exe 61->69         started        71 conhost.exe 61->71         started        73 conhost.exe 61->73         started        file19 signatures20 process21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ea766da00634b64fd5178410bef330b4fd33aa18c78e09ed0a97c9a8efea116/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2021-11-26 08:51:11 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p2twnwqamnfwj7krpbaqx3ztbnh5govbrr4obhwqvf6jvdx6uela._file
Verdict:
malicious
Similar samples:
0a223aa68af0c2af0baabda61d82748629078720a017ef4836f3322a76cb691a
RedLineStealer
0bd71ea13d68490c12e62e4a4e8b17839cba71bacbe16653656e89c65a945652
RedLineStealer
14267da9eb76e935a0e22c8700ba8916d3e31b5997d2a1bc0edfe439d09f435b
RedLineStealer
c1169bf50d13f444cc43302250dedec41a5dfd2c8e122b6ed7de5f2c7bfe8328
RedLineStealer
d2fdb5a27dc6c62388f131aafaa89db7662936a1937bd395613234b60e1699b6
RedLineStealer
f4d185f32721b1c2da2dfdf291154a0c3927fea3e267a4f88f99a49d36ef149a
RedLineStealer
f5eb64043ef2c64c9c971bd9b6c3d6f43702c5e3dd19639327d20db8fb713c99
RedLineStealer
+ 6'511 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:arkei family:redline family:smokeloader family:tofsee family:xmrig botnet:cheat botnet:default backdoor discovery evasion infostealer miner persistence spyware stealer trojan
Link:
https://tria.ge/reports/211126-kr6pxsefb2/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Drops desktop.ini file(s)
Legitimate hosting services abused for malware hosting/C2
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Arkei Stealer Payload
XMRig Miner Payload
Arkei
RedLine
RedLine Payload
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
Tofsee
Windows security bypass
xmrig
Malware Config
C2 Extraction:
http://nalirou70.top/
http://xacokuo80.top/
185.159.80.90:38655
194.58.69.100:37026
http://file-file-host4.com/tratata.php
quadoil.ru
lakeflex.ru
95.181.152.177:21142
Unpacked files
SH256 hash:
cdb9c842ba86fc328ec80226975c54c24a3ee9868cbbaab14d2b651cc80e70e6
MD5 hash:
f7ff52793660cabb5ebd2bd4b9810336
SHA1 hash:
23e6a68262b479a1ff214b09dbfe159292475a22
Link:
https://www.unpac.me/results/4b869291-a72d-4dee-be0f-173093196075/
SH256 hash:
7ea766da00634b64fd5178410bef330b4fd33aa18c78e09ed0a97c9a8efea116
MD5 hash:
674666a8bba0a384c1911750f31481db
SHA1 hash:
3661ad4b8f5cdbbf7b5cf81b0f90f5cd12f6e724
Link:
https://www.unpac.me/results/4b869291-a72d-4dee-be0f-173093196075/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7ea766da0063/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7ea766da00634b64fd5178410bef330b4fd33aa18c78e09ed0a97c9a8efea116

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 7ea766da00634b64fd5178410bef330b4fd33aa18c78e09ed0a97c9a8efea116

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1800988/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/209613/

Comments