MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b22e78e71dee0ab92ed95b9dee69f142bc5a0d112e26ec9615ffaa37894504c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9b22e78e71dee0ab92ed95b9dee69f142bc5a0d112e26ec9615ffaa37894504c
SHA3-384 hash:	e22fe300ccfac0559da44222536cd26392463ae18fac47e5e826ae0c617f1e0d6e11a6e07bcda21ff9207b12c3eb1797
SHA1 hash:	4532609eb662a335bbbe68bc0a3333a5a10ce7c7
MD5 hash:	023f7549aba23f064161a497cd11626b
humanhash:	don-timing-six-nebraska
File name:	023f7549aba23f064161a497cd11626b.exe
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	38'019 bytes
First seen:	2023-12-22 01:00:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3
TLSH	T1E503D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9
TrID	42.6% (.EXE) Win32 Executable (generic) (4505/5/1) 19.2% (.EXE) OS/2 Executable (generic) (2029/13) 18.9% (.EXE) Generic Win/DOS Executable (2002/3) 18.9% (.EXE) DOS Executable Generic (2000/1) 0.2% (.VXD) VXD Driver (29/21)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
5.42.65.31:48396

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

329

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN smoke

Malware family:

smoke

Alert

Create hunting rule

ID:

1

File name:

872aef68846ab8587a930d7d786a1a51.exe

Verdict:

Malicious activity

Analysis date:

2023-12-18 23:57:57 UTC

Tags:

risepro stealer evasion loader smoke smokeloader

Link:

https://app.any.run/tasks/0a0b94fd-1417-4bf8-a204-27a8dac79163

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/468890/

ClamAV Detected

Detection(s):

Win.Packed.Jefpimb-10016846-0

Alert

Create hunting rule

Win.Packed.Razy-10016942-0

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

60%

Tags:

overlay packed xpack

Link:

https://www.filescan.io/uploads/6584dfcff4b6e5e16353fa7c/reports/29337330-5c22-4af5-af83-79f7144bfb7c/overview

Hybrid Analysis Trojan.Heur.Generic

Verdict:

Malicious

Labled as:

Trojan.Heur.Generic

Link:

https://www.hybrid-analysis.com/sample/9b22e78e71dee0ab92ed95b9dee69f142bc5a0d112e26ec9615ffaa37894504c

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cb0a5ce7-bc97-4549-bfbe-f5987611775e

Joe Sandbox Amadey, LummaC Stealer, RedLine, SmokeLo

Result

Threat name:

Amadey, LummaC Stealer, RedLine, SmokeLo

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1365907

Signature

.NET source code contains very large array initializations

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Deletes itself after installation

Found evasive API chain (may stop execution after checking computer name)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected LummaC Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected zgRAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/9b22e78e71dee0ab92ed95b9dee69f142bc5a0d112e26ec9615ffaa37894504c

CERT.PL MWDB smokeloader

Detection:

smokeloader

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/9b22e78e71dee0ab92ed95b9dee69f142bc5a0d112e26ec9615ffaa37894504c/

ReversingLabs TitaniumCloud Win32.Trojan.SmokeLoader

Threat name:

Win32.Trojan.SmokeLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-18 23:56:06 UTC

File Type:

PE (Exe)

AV detection:

30 of 37 (81.08%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tmropdtr33qkxexnsw455zu7cqv4ligrclrg5slbl75kg6eukbga._file

Threatray malicious

Verdict:

malicious

Hatching Triage zgrat

Result

Malware family:

zgrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:amadey family:dcrat family:glupteba family:lumma family:redline family:smokeloader family:stealc family:zgrat botnet:666 botnet:@oleh_ps botnet:up3 backdoor discovery dropper evasion infostealer loader persistence rat spyware stealer themida trojan

Link:

https://tria.ge/reports/231222-bc75rsaccq/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Creates scheduled task(s)

Delays execution with timeout.exe

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Modifies registry class

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

NSIS installer

Enumerates physical storage devices

Program crash

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks BIOS information in registry

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Registers COM server for autorun

Themida packer

Windows security modification

Downloads MZ/PE file

Modifies Windows Firewall

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Amadey

DcRat

Detect Lumma Stealer payload V4

Detect ZGRat V1

Glupteba

Glupteba payload

Lumma Stealer

RedLine

RedLine payload

SmokeLoader

Stealc

Windows security bypass

ZGRat

Malware Config

C2 Extraction:

http://185.215.113.68/fks/index.php
http://5.42.65.125
176.123.7.190:32927
185.172.128.33:38294
http://77.91.76.36
http://host-file-host6.com/
http://host-host-file8.com/
http://attachmentartikidw.fun/api
195.20.16.103:18305

UnpacMe SmokeLoaderStage2 win_smokeloader_a2

Unpacked files

SH256 hash:

9b22e78e71dee0ab92ed95b9dee69f142bc5a0d112e26ec9615ffaa37894504c

MD5 hash:

023f7549aba23f064161a497cd11626b

SHA1 hash:

4532609eb662a335bbbe68bc0a3333a5a10ce7c7

Detections:

SmokeLoaderStage2

Alert

Create hunting rule

win_smokeloader_a2

Alert

Create hunting rule

Link:

https://www.unpac.me/results/18c8293c-9ed4-4192-a48e-323b2e1587f6/

VMRay SmokeLoader

Malware family:

SmokeLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9b22e78e71de/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.46

Link:

https://yomi.yoroi.company/submissions/9b22e78e71dee0ab92ed95b9dee69f142bc5a0d112e26ec9615ffaa37894504c

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/468890/