MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90174f6ac821b5dbe916b4c320e3515f382606a511d800d35c1122da4cf08418. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90174f6ac821b5dbe916b4c320e3515f382606a511d800d35c1122da4cf08418
SHA3-384 hash: f1ae798e731270d595b55256cbf391df4de2d32ce08d5288416efe18deb8f7b0ef8a5d434ab632c0edc139aa3085ca4b
SHA1 hash: c87928d3330c18173599caa7a765e5d59701a596
MD5 hash: c22714390efb2c4cbbd9914e9e294385
humanhash: charlie-finch-oregon-muppet
File name:c22714390efb2c4cbbd9914e9e294385.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:338'432 bytes
First seen:2021-12-26 08:36:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e6044139e58ab69adfc8f485b6284847 (5 x RedLineStealer)
ssdeep 6144:I4IeHNf/CR0kxMsFBitcNF2772mYt4WcHTOcHbSr:IReHV/C0sFBitcNF22mYt4zOce
Threatray 3'302 similar samples on MalwareBazaar
TLSH T154746B10B7A0D035F1B362F449B99279A52FBEE16B2491CB53D62BED96355E0EC3030B
File icon (PE):PE icon
dhash icon badacabecee6baa6 (95 x Stop, 87 x RedLineStealer, 62 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
37.9.13.195:23036

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
37.9.13.195:23036 https://threatfox.abuse.ch/ioc/287771/

Intelligence

File Origin
# of uploads :
1
# of downloads :
342
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c22714390efb2c4cbbd9914e9e294385.exe
Verdict:
Suspicious activity
Analysis date:
2021-12-26 08:40:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3e42b6dd-fd44-46f1-bfff-47f9a5999af1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/216429/
Detection(s):
Win.Packed.Ulise-9917518-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Searching for synchronization primitives
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending an HTTP GET request
Sending a custom TCP request
Running batch commands
Creating a process with a hidden window
Creating a file
Reading critical registry keys
Moving a file to the Windows subdirectory
Launching a process
Changing a file
Creating a file in the %AppData% subdirectories
Launching the process to change the firewall settings
Unauthorized injection to a recently created process
Query of malicious DNS domain
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/3268/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
CheckCmdLine
EvasionGetTickCount
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61c829b04ab5c44cbf51d37d/reports/a06a4d42-dba6-4057-a80c-080a39efb4cd/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/93c250ba-5a45-4ba7-84db-a9931fd9fd90
Result
Threat name:
RedLine SmokeLoader Tofsee Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/912919
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Regsvr32 Anomaly
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 545397 Sample: P8DuhBwVvQ.exe Startdate: 26/12/2021 Architecture: WINDOWS Score: 100 82 parubey.info 185.215.113.58, 443, 49829 WHOLESALECONNECTIONSNL Portugal 2->82 84 91.219.236.18, 80 SERVERASTRA-ASHU Hungary 2->84 86 4 other IPs or domains 2->86 98 Multi AV Scanner detection for domain / URL 2->98 100 Antivirus detection for URL or domain 2->100 102 Antivirus detection for dropped file 2->102 104 21 other signatures 2->104 11 P8DuhBwVvQ.exe 2->11         started        14 hjjitsr 2->14         started        16 sjozpfoq.exe 2->16         started        18 3 other processes 2->18 signatures3 process4 signatures5 114 Contains functionality to inject code into remote processes 11->114 116 Injects a PE file into a foreign processes 11->116 20 P8DuhBwVvQ.exe 11->20         started        118 Machine Learning detection for dropped file 14->118 23 hjjitsr 14->23         started        120 Detected unpacking (changes PE section rights) 16->120 122 Detected unpacking (overwrites its own PE header) 16->122 124 Writes to foreign memory regions 16->124 126 Allocates memory in foreign processes 16->126 process6 signatures7 106 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 20->106 108 Maps a DLL or memory area into another process 20->108 110 Checks if the current machine is a virtual machine (disk enumeration) 20->110 25 explorer.exe 12 20->25 injected 112 Creates a thread in another existing process (thread injection) 23->112 process8 dnsIp9 88 amogohuigotuli.at 25->88 90 185.233.81.115, 443, 49774 SUPERSERVERSDATACENTERRU Russian Federation 25->90 92 16 other IPs or domains 25->92 74 C:\Users\user\AppData\Roaming\hjjitsr, PE32 25->74 dropped 76 C:\Users\user\AppData\Roaming\ffjitsr, PE32 25->76 dropped 78 C:\Users\user\AppData\Local\Temp39.exe, PE32 25->78 dropped 80 12 other files (10 malicious) 25->80 dropped 128 System process connects to network (likely due to code injection or exploit) 25->128 130 Benign windows process drops PE files 25->130 132 Deletes itself after installation 25->132 134 Hides that the sample has been downloaded from the Internet (zone.identifier) 25->134 30 3404.exe 4 25->30         started        34 5D74.exe 2 25->34         started        37 4635.exe 25->37         started        39 2 other processes 25->39 file10 signatures11 process12 dnsIp13 94 45.9.20.149, 49805, 7526 DEDIPATH-LLCUS Russian Federation 30->94 136 Multi AV Scanner detection for dropped file 30->136 138 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 30->138 140 Tries to detect sandboxes and other dynamic analysis tools (window names) 30->140 154 3 other signatures 30->154 64 C:\Users\user\AppData\Local\...\sjozpfoq.exe, PE32 34->64 dropped 142 Detected unpacking (changes PE section rights) 34->142 144 Detected unpacking (overwrites its own PE header) 34->144 146 Machine Learning detection for dropped file 34->146 156 2 other signatures 34->156 41 cmd.exe 34->41         started        44 cmd.exe 34->44         started        46 sc.exe 34->46         started        50 3 other processes 34->50 148 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 37->148 150 Maps a DLL or memory area into another process 37->150 158 2 other signatures 37->158 96 file-file-host4.com 39->96 66 C:\Users\user\AppData\Local\...\6768.exe.log, ASCII 39->66 dropped 68 C:\Users\user\AppData\...\sqlite3[1].dll, PE32 39->68 dropped 70 C:\ProgramData\sqlite3.dll, PE32 39->70 dropped 152 Tries to harvest and steal browser information (history, passwords, etc) 39->152 160 3 other signatures 39->160 48 cmd.exe 39->48         started        file14 signatures15 process16 file17 72 C:\Windows\SysWOW64\...\sjozpfoq.exe (copy), PE32 41->72 dropped 52 conhost.exe 41->52         started        54 conhost.exe 44->54         started        56 conhost.exe 46->56         started        58 conhost.exe 48->58         started        60 conhost.exe 50->60         started        62 conhost.exe 50->62         started        process18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/90174f6ac821b5dbe916b4c320e3515f382606a511d800d35c1122da4cf08418/
Threat name:
Win32.Trojan.Raccrypt
Create hunting rule
Status:
Malicious
First seen:
2021-12-25 22:20:13 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=salu62wieg25x2iwwtbsby2rl44cmbvfchmabu24cernuthqqqma._file
Verdict:
malicious
Similar samples:
0a3eeb453ba4b4728d686d4c79b3131d5117f112ce48c024b694b148510de40e
RedLineStealer
0b23e601c279d2a0a8895a7139427c6abb366e1ba775ca18fd63ba3cb0514ed3
RedLineStealer
0f9b30402f73d225631915acc66cfd6fa860e4050aa7db8e24b111dcb407dc35
RedLineStealer
3d9ebf871e9ada91551158af5078da769ca8bea4014afcd75472deb0d4beb538
RedLineStealer
3f654cc740b18a83fdb840f27cf46f7c8299f51a9a2a6b97b9583ca9e9d9ca5f
RedLineStealer
4883c8f935d8c8397ffb003f72e4e515501820ebd37ca079c478ba5b7ed7b3d4
RedLineStealer
6540d525cae788a13a66d8fb84b0760d43e39e3ec2de5199dd418b2deb703731
RedLineStealer
8a05e6ef4f863b73ec09200c5a19c68e5107bfc0de895ca22ecf1018ea9d4c89
RedLineStealer
acb1d8fdde1f261d7c8c625ae0aab48232bea861532bb66657dda02e1a209d0e
RedLineStealer
b88bcea5dc66a76f3c12117a8a9d1d699b1267d38db666dde881effd96467d0f
RedLineStealer
+ 3'292 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:arkei family:raccoon family:redline family:smokeloader family:tofsee family:xmrig botnet:1 botnet:10da56e7e71e97bdc1f36eb76813bbc3231de7e4 backdoor collection discovery evasion infostealer miner persistence spyware stealer trojan
Link:
https://tria.ge/reports/211226-kh522abdb3/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Arkei Stealer Payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
XMRig Miner Payload
Arkei
Raccoon
RedLine
RedLine Payload
SmokeLoader
Tofsee
Windows security bypass
xmrig
Malware Config
C2 Extraction:
http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
parubey.info
patmushta.info
86.107.197.138:38133
Unpacked files
SH256 hash:
788f723ebfe0110232b52ee15345acc5f74a53ea45e5f422dc5ce2eb5833fadc
MD5 hash:
198ff357daf4345c9fc869616b139381
SHA1 hash:
24c9899b296cf004e400b77e72b89f42bb726f37
Link:
https://www.unpac.me/results/194b2567-c1ac-479d-9500-6239ac28c150/
Parent samples :
3c6f5e38acd57a6372e44dc341bf46060fef8c8b0e1dd3ffa38b21ddaddc3773
6861cdee1ee282ee8c69e31503d95291409907d8b27538f8082adb00205ad105
ccf4e081582226315f3a2bc171b604e3911d0225cc85e18188872ea9832a5388
be1c79275d836696a00b258d15a8b337a8c9beb8198a5bd3d5aaf64d660c8005
53bcd8239258dcbb10f9d3b6d057103c18fe3dd614c5809053426b01b741500d
SH256 hash:
90174f6ac821b5dbe916b4c320e3515f382606a511d800d35c1122da4cf08418
MD5 hash:
c22714390efb2c4cbbd9914e9e294385
SHA1 hash:
c87928d3330c18173599caa7a765e5d59701a596
Link:
https://www.unpac.me/results/194b2567-c1ac-479d-9500-6239ac28c150/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/90174f6ac821b5dbe916b4c320e3515f382606a511d800d35c1122da4cf08418

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 90174f6ac821b5dbe916b4c320e3515f382606a511d800d35c1122da4cf08418

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1919115/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/216429/

Comments