MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1c2492588c6007caf900d15978c9875afa57a3ac2b8b4ea0157d10015ea2ea3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1c2492588c6007caf900d15978c9875afa57a3ac2b8b4ea0157d10015ea2ea3
SHA3-384 hash: 99fa25c63175652b68000389888ffdf188393848bff26198c754b27be89ac76c17f3644dc7359c65040fe733c19bcc85
SHA1 hash: 1b604fb420dd372b887275f712d1899b753bbb7b
MD5 hash: babd7672cca87c5799749f96aa53dc72
humanhash: eleven-speaker-jupiter-william
File name:babd7672cca87c5799749f96aa53dc72.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:37'691 bytes
First seen:2023-12-21 07:40:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3
Threatray 90 similar samples on MalwareBazaar
TLSH T18703D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9
TrID 42.6% (.EXE) Win32 Executable (generic) (4505/5/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
18.9% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
0.2% (.VXD) VXD Driver (29/21)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.233.132.70:13246

Intelligence

File Origin
# of uploads :
1
# of downloads :
334
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
babd7672cca87c5799749f96aa53dc72.exe
Verdict:
Malicious activity
Analysis date:
2023-12-21 07:42:47 UTC
Tags:
loader smoke smokeloader
Link:
https://app.any.run/tasks/e4d1a418-dfa0-4896-9c7e-2f43e40be143

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/468753/
Detection(s):
Win.Packed.Jefpimb-10016846-0
Create hunting rule

Win.Packed.Razy-10016942-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a window
Searching for synchronization primitives
Searching for the window
Launching a process
Creating a file
Launching the default Windows debugger (dwwin.exe)
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed smokeloader xpack
Link:
https://www.filescan.io/uploads/6583ec0fd48681e0d663bcdb/reports/5210bf11-e1da-49c5-9708-5c734d8f08f0/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/a1c2492588c6007caf900d15978c9875afa57a3ac2b8b4ea0157d10015ea2ea3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/baea7d37-8f8a-4666-af39-0461587eaa84
Result
Threat name:
Glupteba, LummaC Stealer, RedLine, Smoke
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1365450
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Connects to many ports of the same IP (likely port scanning)
Contain functionality to detect virtual machines
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found Tor onion address
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses process hollowing technique
Sample uses string decryption to hide its real strings
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
UAC bypass detected (Fodhelper)
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected Glupteba
Yara detected LummaC Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1365450 Sample: 2OcriJkWk6.exe Startdate: 21/12/2023 Architecture: WINDOWS Score: 100 117 host-host-file8.com 2->117 119 host-file-host6.com 2->119 121 13 other IPs or domains 2->121 145 Multi AV Scanner detection for domain / URL 2->145 147 Found malware configuration 2->147 149 Malicious sample detected (through community Yara rule) 2->149 151 18 other signatures 2->151 15 2OcriJkWk6.exe 2->15         started        18 hihhtee 2->18         started        20 duhhtee 2->20         started        signatures3 process4 signatures5 205 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 15->205 207 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 15->207 209 Maps a DLL or memory area into another process 15->209 22 explorer.exe 13 22 15->22 injected 211 Multi AV Scanner detection for dropped file 18->211 213 Checks if the current machine is a virtual machine (disk enumeration) 18->213 215 Creates a thread in another existing process (thread injection) 18->215 217 Sample uses process hollowing technique 20->217 219 Injects a PE file into a foreign processes 20->219 process6 dnsIp7 129 185.215.113.68, 49734, 80 WHOLESALECONNECTIONSNL Portugal 22->129 131 5.42.65.125, 49737, 80 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 22->131 133 4 other IPs or domains 22->133 87 C:\Users\user\AppData\Roaming\hihhtee, PE32 22->87 dropped 89 C:\Users\user\AppData\Roaming\duhhtee, PE32 22->89 dropped 91 C:\Users\user\AppData\Local\Temp\CC36.exe, PE32 22->91 dropped 93 7 other malicious files 22->93 dropped 173 System process connects to network (likely due to code injection or exploit) 22->173 175 Benign windows process drops PE files 22->175 177 Deletes itself after installation 22->177 179 Hides that the sample has been downloaded from the Internet (zone.identifier) 22->179 27 A6B7.exe 6 22->27         started        31 896A.exe 4 22->31         started        33 C724.exe 22->33         started        35 5 other processes 22->35 file8 signatures9 process10 dnsIp11 95 C:\Users\user\AppData\Local\...\toolspub2.exe, PE32 27->95 dropped 97 C:\Users\user\AppData\Local\Temp\etopt.exe, PE32 27->97 dropped 99 C:\Users\user\AppData\...\InstallSetup9.exe, PE32 27->99 dropped 101 C:\...\31839b57a4f11171d6abc8bbc4451ee4.exe, PE32 27->101 dropped 183 Antivirus detection for dropped file 27->183 185 Multi AV Scanner detection for dropped file 27->185 187 Machine Learning detection for dropped file 27->187 38 31839b57a4f11171d6abc8bbc4451ee4.exe 27->38         started        41 toolspub2.exe 27->41         started        43 etopt.exe 27->43         started        57 3 other processes 27->57 103 C:\Users\user\AppData\...\Protect544cd51a.dll, PE32 31->103 dropped 189 Sample uses process hollowing technique 31->189 46 RegSvcs.exe 2 31->46         started        191 Writes to foreign memory regions 33->191 193 Allocates memory in foreign processes 33->193 195 Injects a PE file into a foreign processes 33->195 49 RegAsm.exe 33->49         started        51 conhost.exe 33->51         started        53 WerFault.exe 33->53         started        123 193.233.132.70 FREE-NET-ASFREEnetEU Russian Federation 35->123 125 attachmentartikidw.fun 172.67.197.124, 49746, 80 CLOUDFLARENETUS United States 35->125 127 2 other IPs or domains 35->127 55 conhost.exe 35->55         started        file12 signatures13 process14 dnsIp15 153 Antivirus detection for dropped file 38->153 155 Multi AV Scanner detection for dropped file 38->155 157 Detected unpacking (changes PE section rights) 38->157 171 4 other signatures 38->171 59 cmd.exe 38->59         started        159 Contains functionality to inject code into remote processes 41->159 161 Injects a PE file into a foreign processes 41->161 61 toolspub2.exe 41->61         started        105 C:\Users\user\AppData\Local\Temp\...\Zip.dll, PE32 43->105 dropped 107 C:\Users\user\AppData\Local\...\Checker.dll, PE32 43->107 dropped 109 C:\Program Files (x86)\ClocX\uninst.exe, PE32 43->109 dropped 111 C:\Program Files (x86)\ClocX\ClocX.exe, PE32 43->111 dropped 163 Query firmware table information (likely to detect VMs) 43->163 165 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 43->165 135 195.20.16.103, 18305 EITADAT-ASFI Finland 46->135 137 77.105.132.87 PLUSTELECOM-ASRU Russian Federation 49->137 139 zonealarm.com 209.87.209.205, 443, 49739 ZONEALARM-COMUS United States 57->139 141 multisite3.geo.kaspersky.com 144.121.3.166, 443, 49744, 49745 LIGHTOWERUS United States 57->141 143 malwarebytes.com 192.0.66.233, 443, 49747, 49748 AUTOMATTICUS United States 57->143 113 C:\Users\user\AppData\Local\Temp\...\Math.dll, PE32 57->113 dropped 115 C:\Users\user\AppData\Local\...\INetC.dll, PE32 57->115 dropped 167 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 57->167 169 Contain functionality to detect virtual machines 57->169 64 WerFault.exe 57->64         started        file16 signatures17 process18 signatures19 66 fodhelper.exe 59->66         started        68 conhost.exe 59->68         started        70 fodhelper.exe 59->70         started        72 fodhelper.exe 59->72         started        197 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 61->197 199 Maps a DLL or memory area into another process 61->199 201 Checks if the current machine is a virtual machine (disk enumeration) 61->201 203 Creates a thread in another existing process (thread injection) 61->203 process20 process21 74 31839b57a4f11171d6abc8bbc4451ee4.exe 66->74         started        signatures22 181 Found Tor onion address 74->181 77 31839b57a4f11171d6abc8bbc4451ee4.exe 74->77         started        79 powershell.exe 74->79         started        process23 process24 81 powershell.exe 77->81         started        83 conhost.exe 79->83         started        process25 85 conhost.exe 81->85         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a1c2492588c6007caf900d15978c9875afa57a3ac2b8b4ea0157d10015ea2ea3
Detection:
smokeloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a1c2492588c6007caf900d15978c9875afa57a3ac2b8b4ea0157d10015ea2ea3/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-12-17 00:32:37 UTC
File Type:
PE (Exe)
AV detection:
21 of 23 (91.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uhbesjmiyyahzl4qbukzpdeyowx2k6r2yk4lj2qbk7iqafpkf2rq._file
Verdict:
malicious
Similar samples:
14d49605e8785b94ec8bfb7f2783d513f35793f291c45504aa7a58530eb61116
RedLineStealer
433895b81e5ef461f97327e064b25cb40284a44049e6231c0c60e6f54517138a
RedLineStealer
4c5609ce8dd9b57e711e6c032032ec2fdadf0a3eb89a044847e3e6f85a603e30
RedLineStealer
5056ba5567b664efedda9c48d380f84eeeafc0aafa4ff723d897368972763ce0
RedLineStealer
689a8c848e6cf7d5ddbdceb90aa8513c1b83a9dbe72f57a70ab419264819d107
RedLineStealer
a1c2492588c6007caf900d15978c9875afa57a3ac2b8b4ea0157d10015ea2ea3
RedLineStealer
ce55ffbc3e022895e8e50711a4daf9b3afa4b83f42c6f0c98e76a710ae03821d
RedLineStealer
+ 80 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat family:djvu family:glupteba family:lumma family:redline family:smokeloader family:zgrat botnet:666 botnet:@oleh_ps botnet:@ytlogsbot botnet:livetraffic botnet:up3 backdoor discovery dropper evasion infostealer loader persistence ransomware rat rootkit stealer themida trojan upx
Link:
https://tria.ge/reports/231221-jh4zasagd7/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Enumerates processes with tasklist
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
NSIS installer
Enumerates physical storage devices
Program crash
Checks for VirtualBox DLLs, possible anti-VM trick
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
AutoIT Executable
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Manipulates WinMonFS driver.
Modifies boot configuration data using bcdedit
Checks BIOS information in registry
Deletes itself
Drops startup file
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Registers COM server for autorun
Themida packer
UPX packed file
Windows security modification
Downloads MZ/PE file
Modifies Windows Firewall
Identifies VirtualBox via ACPI registry values (likely anti-VM)
DcRat
Detect Lumma Stealer payload V4
Detect ZGRat V1
Detected Djvu ransomware
Djvu Ransomware
Glupteba
Glupteba payload
Lumma Stealer
RedLine
RedLine payload
SmokeLoader
Windows security bypass
ZGRat
Malware Config
C2 Extraction:
http://185.215.113.68/fks/index.php
176.123.7.190:32927
195.20.16.190:45294
http://host-file-host6.com/
http://host-host-file8.com/
77.105.132.87:22221
http://zexeq.com/test1/get.php
http://attachmentartikidw.fun/api
195.20.16.103:18305
Unpacked files
SH256 hash:
a1c2492588c6007caf900d15978c9875afa57a3ac2b8b4ea0157d10015ea2ea3
MD5 hash:
babd7672cca87c5799749f96aa53dc72
SHA1 hash:
1b604fb420dd372b887275f712d1899b753bbb7b
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/fd823458-ea12-43cb-a8c4-94722985f9cf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a1c2492588c6007caf900d15978c9875afa57a3ac2b8b4ea0157d10015ea2ea3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/468753/

Comments