MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b58105b315bbd6a5af96e63f88dc59cdedef401324916ae48de270a021ec29d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs 1 YARA File information Comments

SHA256 hash:	9b58105b315bbd6a5af96e63f88dc59cdedef401324916ae48de270a021ec29d
SHA3-384 hash:	0ef6e61011410235a0bacc47cd73874c1cc56da06b73c37fec5b6644daac64eb88fea0efaa168b1bc1f97a82eb43fc31
SHA1 hash:	3b7e6914f7c05549b08f81c7220c5099773d917c
MD5 hash:	c7278a4f0f53553e868f234dad31fbd3
humanhash:	double-mango-early-wisconsin
File name:	c7278a4f0f53553e868f234dad31fbd3.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	320'512 bytes
First seen:	2022-01-14 14:25:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	cfc1be3ef30447c889df3bb658d73d71 (2 x RedLineStealer, 1 x CoinMiner.XMRig, 1 x Smoke Loader)
ssdeep	6144:CUY3MnekTMJJat0i9H3bwIyrAT47/Wem/ZaTd:CjMnezJFIXbryET4Semk
Threatray	3'870 similar samples on MalwareBazaar
TLSH	T11C649F10A7A0C435F5B722F846B693ADB53E3AB15B2450CF22D52AEE57386E1EC31317
File icon (PE):
dhash icon	2dac1370319b9b91 (22 x Smoke Loader, 20 x RedLineStealer, 18 x Amadey)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
65.108.77.212:40094

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
65.108.77.212:40094	https://threatfox.abuse.ch/ioc/294752/

Intelligence

File Origin

# of uploads :

# of downloads :

299

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

c7278a4f0f53553e868f234dad31fbd3.exe

Verdict:

Suspicious activity

Analysis date:

2022-01-14 14:30:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/21850932-0933-44f9-88b8-74ba2c4db4fa

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/219346/

Detection(s):

Win.Packed.Tofsee-9935687-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Unauthorized injection to a recently created process

DNS request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Sending an HTTP GET request

Query of malicious DNS domain

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/4197/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

CPUID_Instruction

EvasionQueryPerformanceCounter

EvasionGetTickCount

CheckCmdLine

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware tofsee

Link:

https://www.filescan.io/uploads/61e187fef2e8ec86fefd2811/reports/7891d6da-1872-43d7-bf07-abb2cbe00283/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/729cee86-fb8e-4161-b228-e3a3d6d059fe

Result

Threat name:

Amadey Raccoon RedLine SmokeLoader Tofse

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/920790

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Command shell drops VBS files

Contains functionality to detect sleep reduction / modifications

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after checking computer name)

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Modifies the windows firewall

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file has nameless sections

Potential malicious VBS script found (suspicious strings)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Sigma detected: Copying Sensitive Files with Credential Data

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Suspicious Svchost Process

Sigma detected: Suspicius Add Task From User AppData Temp

Sigma detected: WScript or CScript Dropper

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Amadeys stealer DLL

Yara detected BatToExe compiled binary

Yara detected Raccoon Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Tofsee

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9b58105b315bbd6a5af96e63f88dc59cdedef401324916ae48de270a021ec29d/

Threat name:

Win32.Backdoor.Mokes

Status:

Malicious

First seen:

2022-01-14 14:26:13 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 28 (64.29%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=tnmbawzrlo6wuwxznzr7rdofttpn55abgjernlsi3ytquaq6ykoq._file

Verdict:

malicious

RedLineStealer

1b8192ec7f52e9056f5f2c83f0a9c56c83469575fded613e6ae7c1f3505a3c1d

RedLineStealer

1d13b2332be93f6fbcb4499d1e3ccd075496b4483f610e9b996d0896d4faf435

RedLineStealer

40e53888088f51617c2460792d953c5d3a8503eb17c3389614d3f8412bf1661d

RedLineStealer

55f429935a1ccd1ded86968c7ee688a3169031789ce4b1c23ad2375daef8d911

RedLineStealer

a0f70f88c9a376e7c0f7e508c796bf1dbbf58ff8b172b9aff3421be63e2d7f78

RedLineStealer

a233b4b4782811424b0b5b166b0985417e834da2b776e72d3c7e5064dee1e9e5

RedLineStealer

+ 3'860 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:amadey family:arkei family:raccoon family:smokeloader family:tofsee family:xmrig botnet:default backdoor collection discovery evasion miner persistence spyware stealer trojan upx

Link:

https://tria.ge/reports/220114-rrv2ragff6/

Behaviour

Checks SCSI registry key(s)

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Program crash

Launches sc.exe

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

UPX packed file

Arkei Stealer Payload

XMRig Miner Payload

Amadey

Arkei

Raccoon

SmokeLoader

Tofsee

Windows security bypass

xmrig

Malware Config

C2 Extraction:

http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
http://file-file-host4.com/tratata.php
patmushta.info
parubey.info
185.215.113.35/d2VxjasuwS/index.php