🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e0bf87628ea9c37fd9a0ca40fbbac0bf8d219f2f514efad2f63e0ba90cf7dd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs 2 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e0bf87628ea9c37fd9a0ca40fbbac0bf8d219f2f514efad2f63e0ba90cf7dd4
SHA3-384 hash: 0e9f826a52603af40bbb43d7ddd748eea43ebb4a75a1fd6a245d5adb1aeef96b84864c55749b8346e44d2c1d843a92ae
SHA1 hash: 09efbeb35ec58e831ac58eeeac41947640d72a9d
MD5 hash: 3d36f877680341511604f09550d7dd20
humanhash: illinois-tennis-illinois-timing
File name:3d36f877680341511604f09550d7dd20.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:184'832 bytes
First seen:2021-09-29 03:06:12 UTC
Last seen:2021-09-29 04:06:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d34c2e9386a3eb95da4c6fd4346f4c9d (4 x ArkeiStealer, 3 x RedLineStealer, 1 x CoinMiner)
ssdeep 3072:ujkQUZ8dsDPCarNvnG8B1rcPI1ZeMy7BPqT8EuSzQz:ujwZPC2JGScPI1LIBPqFuSzC
Threatray 4'970 similar samples on MalwareBazaar
TLSH T12F04AE10B590D2B1C745013EA829CAECE53EB56DFBF05A373B9426DFAE782A37121351
File icon (PE):PE icon
dhash icon 4839b234e8c38890 (121 x RaccoonStealer, 54 x RedLineStealer, 51 x ArkeiStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.56.146.60:18243

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
193.56.146.60:18243 https://threatfox.abuse.ch/ioc/227509/
http://185.215.113.13/g4MbvE/index.php https://threatfox.abuse.ch/ioc/227531/

Intelligence

File Origin
# of uploads :
2
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3d36f877680341511604f09550d7dd20.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-29 03:07:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1075462d-ec19-40c0-a88a-d60e1c17207c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/192753/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.26425.25941.23386.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b79cfdc9-326c-42cb-a8a9-a6c7ce6a127f
Result
Threat name:
RedLine SmokeLoader Tofsee
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/860495
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to start a terminal service
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 492924 Sample: e2PUyYo6kv.exe Startdate: 29/09/2021 Architecture: WINDOWS Score: 100 71 defeatwax.ru 2->71 73 cdn.discordapp.com 2->73 75 api.ip.sb 2->75 87 Antivirus detection for URL or domain 2->87 89 Multi AV Scanner detection for dropped file 2->89 91 Multi AV Scanner detection for submitted file 2->91 93 12 other signatures 2->93 11 e2PUyYo6kv.exe 2->11         started        14 evtedsi 2->14         started        16 svchost.exe 2->16         started        18 9 other processes 2->18 signatures3 process4 dnsIp5 111 Detected unpacking (changes PE section rights) 11->111 21 e2PUyYo6kv.exe 11->21         started        113 Multi AV Scanner detection for dropped file 14->113 115 Contains functionality to inject code into remote processes 14->115 117 Injects a PE file into a foreign processes 14->117 24 evtedsi 14->24         started        119 Changes security center settings (notifications, updates, antivirus, firewall) 16->119 77 127.0.0.1 unknown unknown 18->77 signatures6 process7 signatures8 95 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 21->95 97 Maps a DLL or memory area into another process 21->97 99 Checks if the current machine is a virtual machine (disk enumeration) 21->99 101 Creates a thread in another existing process (thread injection) 21->101 26 explorer.exe 15 21->26 injected process9 dnsIp10 79 193.56.146.41, 49811, 9080 LVLT-10753US unknown 26->79 81 216.128.137.31, 80 AS-CHOOPAUS United States 26->81 83 11 other IPs or domains 26->83 63 C:\Users\user\AppData\Roaming\evtedsi, PE32 26->63 dropped 65 C:\Users\user\AppData\Local\Temp\CB10.exe, PE32 26->65 dropped 67 C:\Users\user\AppData\Local\Temp\B11F.exe, PE32 26->67 dropped 69 5 other files (4 malicious) 26->69 dropped 121 System process connects to network (likely due to code injection or exploit) 26->121 123 Benign windows process drops PE files 26->123 125 Deletes itself after installation 26->125 127 Hides that the sample has been downloaded from the Internet (zone.identifier) 26->127 31 AA76.exe 26->31         started        34 2FCE.exe 26->34         started        36 B11F.exe 2 26->36         started        38 CB10.exe 7 26->38         started        file11 signatures12 process13 file14 129 Detected unpacking (changes PE section rights) 31->129 41 AA76.exe 31->41         started        131 Query firmware table information (likely to detect VMs) 34->131 133 Tries to detect sandboxes and other dynamic analysis tools (window names) 34->133 135 Hides threads from debuggers 34->135 137 Tries to detect sandboxes / dynamic malware analysis system (registry check) 34->137 139 Antivirus detection for dropped file 36->139 141 Multi AV Scanner detection for dropped file 36->141 143 Machine Learning detection for dropped file 36->143 145 Injects a PE file into a foreign processes 36->145 44 B11F.exe 2 36->44         started        47 conhost.exe 36->47         started        59 C:\Users\user\AppData\Local\Temp\...\7z.exe, PE32+ 38->59 dropped 61 C:\Users\user\AppData\Local\Temp\...\7z.dll, PE32+ 38->61 dropped 147 Contains functionality to register a low level keyboard hook 38->147 49 cmd.exe 38->49         started        signatures15 process16 dnsIp17 103 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 41->103 105 Maps a DLL or memory area into another process 41->105 107 Checks if the current machine is a virtual machine (disk enumeration) 41->107 109 Creates a thread in another existing process (thread injection) 41->109 85 92.246.89.6, 38437, 49833 LIVECOMM-ASRespublikanskayastr3k6RU Russian Federation 44->85 51 conhost.exe 49->51         started        53 mode.com 49->53         started        55 7z.exe 49->55         started        57 3 other processes 49->57 signatures18 process19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e0bf87628ea9c37fd9a0ca40fbbac0bf8d219f2f514efad2f63e0ba90cf7dd4/
Threat name:
Win32.Trojan.Racealer
Create hunting rule
Status:
Malicious
First seen:
2021-09-29 03:06:16 UTC
AV detection:
25 of 45 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ryf7q5ri5kodp7m2bssa7o5mbp4negps6uko7ljpmpqlvegppxka._file
Verdict:
malicious
Similar samples:
133304b5052863dc2916413ac706f13189ac5a40698bdcbc30f2ed82dd99a1eb
RedLineStealer
39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b
RedLineStealer
8350538160b089becbb7142d16ecf8089b16fbf11ead40dc1169a9e6104c0304
RedLineStealer
843140b0a3f095d74fe2682d3ae029d4da70a5bae79850cf047a72c9d4a882c0
RedLineStealer
8fe0e96079608b65906be8b65e589d44d73d1b46de789752c5ec47e79d3976c6
RedLineStealer
e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143
RedLineStealer
f721b4e5cdae494fceec605a3cffbf5824341258b43660cd1c9fe72c691a9594
RedLineStealer
f7e22e20cd90f57ce6025dfb5bd05d49963e1915c18abcf16af7503a7215be8b
RedLineStealer
f8eee2152f76d73d0eaa7be03d1232fdf15cf798167f43f06f4a58751780cd8a
RedLineStealer
f9edbff29a53d95b7eb874b4db8cc83cae6c61f8c7e1d79176d68bf09a842167
RedLineStealer
+ 4'960 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader botnet:5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 botnet:777777 backdoor discovery evasion infostealer spyware stealer suricata trojan
Link:
https://tria.ge/reports/210929-dlwjfadefk/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Modifies system certificate store
Modifies registry class
Delays execution with timeout.exe
Checks SCSI registry key(s)
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Enumerates connected drives
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Reads user/profile data of web browsers
Windows security modification
Reads user/profile data of local email clients
Loads dropped DLL
Drops startup file
Deletes itself
Executes dropped EXE
Downloads MZ/PE file
Blocklisted process makes network request
Nirsoft
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Amadey CnC Check-In
Windows security bypass
Turns off Windows Defender SpyNet reporting
SmokeLoader
RedLine Payload
RedLine
Raccoon
Modifies Windows Defender Real-time Protection settings
Malware Config
C2 Extraction:
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
193.56.146.60:18243
Unpacked files
SH256 hash:
2fead9437f15e057951fd6a02ab05076e38db13483df0191787c21c79343b9e7
MD5 hash:
1c90f3a3fcd93ee08b2154cbcff49085
SHA1 hash:
73ac881633a13c3c31c1153d8105b8ecbb60961e
Link:
https://www.unpac.me/results/985f460c-2e91-4615-9834-e44854cb4516/
SH256 hash:
8e0bf87628ea9c37fd9a0ca40fbbac0bf8d219f2f514efad2f63e0ba90cf7dd4
MD5 hash:
3d36f877680341511604f09550d7dd20
SHA1 hash:
09efbeb35ec58e831ac58eeeac41947640d72a9d
Link:
https://www.unpac.me/results/985f460c-2e91-4615-9834-e44854cb4516/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8e0bf87628ea/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e0bf87628ea9c37fd9a0ca40fbbac0bf8d219f2f514efad2f63e0ba90cf7dd4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 8e0bf87628ea9c37fd9a0ca40fbbac0bf8d219f2f514efad2f63e0ba90cf7dd4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1639930/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/192753/

Comments