MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a73b323f8aa04093e8200196cb373035dd6f10d30ae0316f666bf6fbcdf4fe4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a73b323f8aa04093e8200196cb373035dd6f10d30ae0316f666bf6fbcdf4fe4f
SHA3-384 hash: e044442519500d09f214ccc95326d625c58962766b478112deef38eb8c5eeac0b9233501c460f40ee60c9c4dc823d300
SHA1 hash: 6bd5e9c23bd3b5c70c444f2040cfe61f206da86a
MD5 hash: 97a50e4f411d03938e2fa231d0538ba1
humanhash: item-oranges-sierra-mexico
File name:97a50e4f411d03938e2fa231d0538ba1.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:294'400 bytes
First seen:2021-12-18 16:16:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d5ad0dd900bc145ad0c026557134f094 (16 x RedLineStealer, 2 x CoinMiner)
ssdeep 6144:S38NOrTQXGQFb0BfXLiT9iyva5PZvqBCmBM1DqmBFrt:S38cPESBPLiBiyva5ZByM1Dq6
Threatray 5'971 similar samples on MalwareBazaar
TLSH T1AE549E00B7A0C435F1B713F849BA93BDB53E79A16BB5A0CB62D516EA1674AE0DC30347
File icon (PE):PE icon
dhash icon 2dec1370399b9b91 (25 x RedLineStealer, 21 x Smoke Loader, 8 x ArkeiStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
http://82.146.39.79/Camphpboot/localscreen/Pythondata/Pythonrecordframebin/EternalphpUpdateBigloadDb.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://82.146.39.79/Camphpboot/localscreen/Pythondata/Pythonrecordframebin/EternalphpUpdateBigloadDb.php https://threatfox.abuse.ch/ioc/277379/

Intelligence

File Origin
# of uploads :
1
# of downloads :
208
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
Win.Malware.Sabsik-9916379-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
DNS request
Sending a custom TCP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Query of malicious DNS domain
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/2511/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61be0987ec6c6c14a9e04c30/reports/c1a30add-e49d-4194-a804-66922c31881d/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a895a702-461b-41c6-a586-faef61e20315
Result
Threat name:
RedLine SmokeLoader Tofsee Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/909582
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Detected VMProtect packer
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses netsh to modify the Windows network and firewall settings
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 542056 Sample: EqPKg4Y9Wj.exe Startdate: 18/12/2021 Architecture: WINDOWS Score: 100 64 microsoft-com.mail.protection.outlook.com 40.93.207.1, 25, 49866 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 2->64 66 45.159.189.39, 49888, 8080 HOSTING-SOLUTIONSUS Netherlands 2->66 68 6 other IPs or domains 2->68 96 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->96 98 Multi AV Scanner detection for domain / URL 2->98 100 Antivirus detection for URL or domain 2->100 102 14 other signatures 2->102 10 EqPKg4Y9Wj.exe 2->10         started        12 bwiavbf 2->12         started        15 svchost.exe 1 2->15         started        18 4 other processes 2->18 signatures3 process4 dnsIp5 20 EqPKg4Y9Wj.exe 10->20         started        120 Machine Learning detection for dropped file 12->120 122 Contains functionality to inject code into remote processes 12->122 124 Injects a PE file into a foreign processes 12->124 23 bwiavbf 12->23         started        76 192.168.2.1 unknown unknown 15->76 78 host-data-coin-11.com 15->78 25 WerFault.exe 18->25         started        signatures6 process7 signatures8 104 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 20->104 106 Maps a DLL or memory area into another process 20->106 108 Checks if the current machine is a virtual machine (disk enumeration) 20->108 110 Creates a thread in another existing process (thread injection) 20->110 27 explorer.exe 12 20->27 injected process9 dnsIp10 70 185.233.81.115, 443, 49783 SUPERSERVERSDATACENTERRU Russian Federation 27->70 72 37.49.230.237, 80 ESTROWEBNL Estonia 27->72 74 13 other IPs or domains 27->74 54 C:\Users\user\AppData\Roaming\bwiavbf, PE32 27->54 dropped 56 C:\Users\user\AppData\Local\Temp818.exe, PE32 27->56 dropped 58 C:\Users\user\AppData\Local\Temp\AFCE.exe, PE32 27->58 dropped 60 8 other files (6 malicious) 27->60 dropped 126 System process connects to network (likely due to code injection or exploit) 27->126 128 Benign windows process drops PE files 27->128 130 Deletes itself after installation 27->130 132 Hides that the sample has been downloaded from the Internet (zone.identifier) 27->132 32 5653.exe 127 27->32         started        37 8CD3.exe 27->37         started        39 61DD.exe 2 27->39         started        41 2 other processes 27->41 file11 signatures12 process13 dnsIp14 62 file-file-host4.com 32->62 48 C:\Users\user\AppData\...\sqlite3[1].dll, PE32 32->48 dropped 50 C:\ProgramData\sqlite3.dll, PE32 32->50 dropped 80 Detected unpacking (changes PE section rights) 32->80 82 Detected unpacking (overwrites its own PE header) 32->82 84 Machine Learning detection for dropped file 32->84 94 3 other signatures 32->94 86 Multi AV Scanner detection for dropped file 37->86 43 8CD3.exe 37->43         started        52 C:\Users\user\AppData\Local\...\wgulobyn.exe, PE32 39->52 dropped 88 Uses netsh to modify the Windows network and firewall settings 39->88 90 Modifies the windows firewall 39->90 92 Injects a PE file into a foreign processes 41->92 46 WerFault.exe 23 9 41->46         started        file15 signatures16 process17 signatures18 112 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 43->112 114 Maps a DLL or memory area into another process 43->114 116 Checks if the current machine is a virtual machine (disk enumeration) 43->116 118 Creates a thread in another existing process (thread injection) 43->118
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a73b323f8aa04093e8200196cb373035dd6f10d30ae0316f666bf6fbcdf4fe4f/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2021-12-18 14:41:00 UTC
File Type:
PE (Exe)
Extracted files:
22
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u45tep4kubajh2baaglmwnzqgxow6egtblqdc33gnp3pxtpu7zhq._file
Verdict:
malicious
Similar samples:
054db71cd59068690009183dc807efaf1f2ddb6e1d14ef680ab786460094fabf
RedLineStealer
0766319b5e59356a77cd84ceb1a752b7b39c03a0f978ec5a1d7f59556bf00f42
RedLineStealer
512cce5521eb9318fe0d2ef81c10af7b74257e71a3f412d2e3bd0e0f89c8ef2e
RedLineStealer
8b9e0f5fe004e455146bc5f0ef6ae8e2d9645c9e5090a4cf044fa2fbe53a0f4d
RedLineStealer
8ef37ea30b02c84914a88d1516e1d595de99fbc4e38a2bc0fd1fee766e9a178b
RedLineStealer
97846ca62ffbac16afd4ab5cd5abfbce405ccebe5e6a86ee2d6aed87660410ba
RedLineStealer
a99743495cee5a17b40bd14b3db7e0d2e61f99a0e1cc7d29d419d48861dd7423
RedLineStealer
e35c69fa5d52a1295092a91cb40fb471065619521830af3e5410107536aab19d
RedLineStealer
+ 5'961 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/211218-trcxaafch5/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
SmokeLoader
Malware Config
C2 Extraction:
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Unpacked files
SH256 hash:
196c516ea546fb935ac669681a74a4dc80da79d9088f464f6cc6f126ae934f4e
MD5 hash:
c36de8bc9668ec4eaafca4c349dca0d5
SHA1 hash:
ea2cadfada69b93ca3abeb8b2462c5c18891fabf
Link:
https://www.unpac.me/results/1490ffe1-c89f-4f2b-841a-36ea1db740a6/
Parent samples :
6b2d7c8bdedb901d80c89717c9889abf169c9059d8bb545af6ca1960660324ad
8928eed86ea55a63e3646bf8ca403b4b1e57702f73c1ecc8fa403b5700a304ef
18ad362dcae8df5827846223c09ceba7766e09733b685d4067ee39037daec452
da39948d95cdbce6e1ca9e0fdbb77080164a379f593e530b5732d3fc38df7bf8
7c74a8c41e24f69015185f78b8fbc177edcbe9d27099e904497b2310999f74cb
92ebb6be19502fe2573a9eac183bcc657b88ac5b0344285d9db409b0a3d88dab
af6fa095b427a0e95dd826696c2b92b0123e688e3c95f6d27825cc2928085d1b
de8099732ee5b73f3fa6d032a74e8576d06663fc16b2c6da27a34444fdced1c8
SH256 hash:
a73b323f8aa04093e8200196cb373035dd6f10d30ae0316f666bf6fbcdf4fe4f
MD5 hash:
97a50e4f411d03938e2fa231d0538ba1
SHA1 hash:
6bd5e9c23bd3b5c70c444f2040cfe61f206da86a
Link:
https://www.unpac.me/results/1490ffe1-c89f-4f2b-841a-36ea1db740a6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a73b323f8aa04093e8200196cb373035dd6f10d30ae0316f666bf6fbcdf4fe4f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe a73b323f8aa04093e8200196cb373035dd6f10d30ae0316f666bf6fbcdf4fe4f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1886977/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/215018/

Comments