MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4a3cafc8553c06b17131e6b3afb38971312a4d91ae3349d2d118bdfc3d8de94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4a3cafc8553c06b17131e6b3afb38971312a4d91ae3349d2d118bdfc3d8de94
SHA3-384 hash: 820f8587578bdf1d67d0f1173fecf363d3b5b34d196c256a492172f088a0d1b2f6071891ef28fcc2409ce79cd19dc40d
SHA1 hash: 4bc97f2b60126a91d2b58edd4f582651fab22a77
MD5 hash: 355e3d27dafacdfb7b79e62f635c2d29
humanhash: helium-carbon-connecticut-echo
File name:b4a3cafc8553c06b17131e6b3afb38971312a4d91ae33.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:339'968 bytes
First seen:2021-12-27 07:20:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4b8a20830d5d5ec659fda08d2e209e3 (10 x RedLineStealer, 1 x RaccoonStealer)
ssdeep 6144:MEyXKVOIQCJ27JQyax56crHTmSLBGYHSwhS+F6BZ:M/a52+yax56crzmSL7ywhW
Threatray 4'073 similar samples on MalwareBazaar
TLSH T1FD746B10B7A0D039F5B352F489B99278B52F7EE12B2491CB53D526EE96356E0EC3031B
File icon (PE):PE icon
dhash icon b2dacabecee6baa6 (148 x RedLineStealer, 145 x Stop, 100 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
81.176.229.76:31970

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
81.176.229.76:31970 https://threatfox.abuse.ch/ioc/287793/

Intelligence

File Origin
# of uploads :
1
# of downloads :
235
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b4a3cafc8553c06b17131e6b3afb38971312a4d91ae33.exe
Verdict:
Suspicious activity
Analysis date:
2021-12-27 11:49:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2acd20f2-f576-4bc5-80aa-4d600781a46a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/216506/
Detection(s):
Win.Packed.Generic-9918587-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
DNS request
Sending a custom TCP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Query of malicious DNS domain
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/3320/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61c969608991ba72b39a86cd/reports/badbda4b-2720-4f5b-a62e-45826c62cca8/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7befa66c-3a29-41d5-8f9a-6ca2b64f2eee
Result
Threat name:
RedLine SmokeLoader Tofsee Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/913039
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
PE file contains section with special chars
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Sigma detected: Copying Sensitive Files with Credential Data
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 545517 Sample: b4a3cafc8553c06b17131e6b3af... Startdate: 27/12/2021 Architecture: WINDOWS Score: 100 88 t.me 2->88 90 data-file-data-7.com 2->90 92 cdn.discordapp.com 2->92 128 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->128 130 Multi AV Scanner detection for domain / URL 2->130 132 Antivirus detection for URL or domain 2->132 134 15 other signatures 2->134 11 b4a3cafc8553c06b17131e6b3afb38971312a4d91ae33.exe 2->11         started        13 gegvrsr 2->13         started        16 svchost.exe 2->16         started        18 10 other processes 2->18 signatures3 process4 signatures5 20 b4a3cafc8553c06b17131e6b3afb38971312a4d91ae33.exe 11->20         started        144 Machine Learning detection for dropped file 13->144 146 Contains functionality to inject code into remote processes 13->146 148 Injects a PE file into a foreign processes 13->148 23 gegvrsr 13->23         started        150 Changes security center settings (notifications, updates, antivirus, firewall) 16->150 25 MpCmdRun.exe 16->25         started        process6 signatures7 136 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 20->136 138 Maps a DLL or memory area into another process 20->138 140 Checks if the current machine is a virtual machine (disk enumeration) 20->140 27 explorer.exe 12 20->27 injected 142 Creates a thread in another existing process (thread injection) 23->142 32 conhost.exe 25->32         started        process8 dnsIp9 98 185.233.81.115, 443, 49762 SUPERSERVERSDATACENTERRU Russian Federation 27->98 100 188.166.28.199, 80 DIGITALOCEAN-ASNUS Netherlands 27->100 102 13 other IPs or domains 27->102 78 C:\Users\user\AppData\Roaming\gegvrsr, PE32 27->78 dropped 80 C:\Users\user\AppData\Local\Temp\BFAA.exe, PE32 27->80 dropped 82 C:\Users\user\AppData\Local\Temp\B512.exe, PE32 27->82 dropped 84 9 other malicious files 27->84 dropped 152 System process connects to network (likely due to code injection or exploit) 27->152 154 Benign windows process drops PE files 27->154 156 Deletes itself after installation 27->156 158 Hides that the sample has been downloaded from the Internet (zone.identifier) 27->158 34 9906.exe 27->34         started        37 8299.exe 2 27->37         started        40 B512.exe 27->40         started        42 2 other processes 27->42 file10 signatures11 process12 dnsIp13 104 Multi AV Scanner detection for dropped file 34->104 106 Machine Learning detection for dropped file 34->106 108 Injects a PE file into a foreign processes 34->108 45 9906.exe 34->45         started        94 45.9.20.149, 7526 DEDIPATH-LLCUS Russian Federation 37->94 110 Detected unpacking (changes PE section rights) 37->110 112 Tries to detect sandboxes and other dynamic analysis tools (window names) 37->112 114 Tries to evade analysis by execution special instruction which cause usermode exception 37->114 116 Hides threads from debuggers 37->116 118 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 40->118 48 B512.exe 40->48         started        96 file-file-host4.com 42->96 72 C:\Users\user\AppData\Local\...\ongeavii.exe, PE32 42->72 dropped 74 C:\Users\user\AppData\...\sqlite3[1].dll, PE32 42->74 dropped 76 C:\ProgramData\sqlite3.dll, PE32 42->76 dropped 120 Detected unpacking (overwrites its own PE header) 42->120 122 Tries to harvest and steal browser information (history, passwords, etc) 42->122 124 Tries to steal Crypto Currency Wallets 42->124 126 Contains functionality to detect sleep reduction / modifications 42->126 51 cmd.exe 42->51         started        53 cmd.exe 42->53         started        56 cmd.exe 42->56         started        58 sc.exe 42->58         started        file14 signatures15 process16 dnsIp17 160 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 45->160 162 Maps a DLL or memory area into another process 45->162 164 Checks if the current machine is a virtual machine (disk enumeration) 45->164 166 Creates a thread in another existing process (thread injection) 45->166 86 86.107.197.138, 38133, 49862 MOD-EUNL Romania 48->86 168 Tries to harvest and steal browser information (history, passwords, etc) 48->168 170 Tries to steal Crypto Currency Wallets 48->170 60 conhost.exe 51->60         started        62 timeout.exe 51->62         started        70 C:\Windows\SysWOW64\...\ongeavii.exe (copy), PE32 53->70 dropped 64 conhost.exe 53->64         started        66 conhost.exe 56->66         started        68 conhost.exe 58->68         started        file18 signatures19 process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4a3cafc8553c06b17131e6b3afb38971312a4d91ae3349d2d118bdfc3d8de94/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2021-12-27 07:21:08 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wsr4v7efkpagwfytdzvtv6zys4jrfjgzdlrtjhjncgf57q6y32ka._file
Verdict:
malicious
Similar samples:
2cd29b8b5c71f0f7df5dd0bcedbb134977d9c6269861dddd65db1db203194c08
RedLineStealer
38a2144651bd3980612f92a1cd2308adf10dd630d618ee05232bf1a8cf76444c
RedLineStealer
3d030fbfbe328bc4f276d565854f89189094ddb46dc1c6d36e8e9a438227279f
RedLineStealer
64edbaff99fe8c87c2f5f826b0d1741c575295e3ab0c3d16db8bbacd2baebd30
RedLineStealer
9230d8e8791a48bcca68a199b29e0be82d17d4079bbe715953ca35a2101b6d6b
RedLineStealer
c0efa247a497b4d9d721d0f54e30e44007c5e53882cf822ade5c3b8f9dd6bbaf
RedLineStealer
e59a89138d5d7d96b4336b9323be581e35b3056180cc4fcf2844027534d5c189
RedLineStealer
f3a0806bf7e9030e703483f4469a2292d9595d500a2365336de454a3bf047e26
RedLineStealer
feb365d784b06535c3bd3ab5c525e771521f0f7dcc71c8c3e800226fdb117085
RedLineStealer
+ 4'063 additional samples on MalwareBazaar
Result
Malware family:
tofsee
Create hunting rule
Score:
  10/10
Tags:
family:arkei family:raccoon family:redline family:smokeloader family:tofsee botnet:10da56e7e71e97bdc1f36eb76813bbc3231de7e4 backdoor discovery evasion infostealer persistence spyware stealer suricata trojan
Link:
https://tria.ge/reports/211227-h6nfsaahcl/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Launches sc.exe
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Arkei Stealer Payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Arkei
Raccoon
RedLine
RedLine Payload
SmokeLoader
Tofsee
Windows security bypass
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
Malware Config
C2 Extraction:
http://host-data-coin-11.com/
http://file-coin-host-12.com/
parubey.info
patmushta.info
Unpacked files
SH256 hash:
721d393191597d49d856baef2fbde75e48f52d0465e2cfabf1a41848b0e05589
MD5 hash:
b984a027c8a2abf874f3eb306a831613
SHA1 hash:
d3b3f8890adc840b0bd411cf304eef15d415ed48
Link:
https://www.unpac.me/results/cc5fa257-d04d-4cd5-9cc1-b3fd7ac99e76/
Parent samples :
fb9b41efdc7c2d9e8cfda4be223831a9d2f4d21366759da64e04bbbb9e662766
bc9d49f4f0d51c57b34515616d5e6a23a37fec03f8884d8305db0806bd6138fc
ecb96fec4db4a1eecef04c8ef12b260bb419407111c1263664749481b7fa5387
98c920233869ce802fb4722f982fc1a8c2461e2a01ea4a619a9532a660acf285
2fde1682e006e27b2deb49595ab3baf37a836577fbe9efdfae59d4b6b682d8b7
2374069183727dd5904a26027c80032f30dcff60d25019578876c0b37fa9c224
bd3030832602591f05fe01ef11feaa3b9fe776b2a184eb454f02cae3ab73340b
a0f15f4665835bb7f3b07d5e96d2b08af8e88614c9b22fc9fff86f4f60ee1a8e
c91dec1cd5b97079481c76d5d597dde67b60c301ea900eab7db99776d52b465a
SH256 hash:
b4a3cafc8553c06b17131e6b3afb38971312a4d91ae3349d2d118bdfc3d8de94
MD5 hash:
355e3d27dafacdfb7b79e62f635c2d29
SHA1 hash:
4bc97f2b60126a91d2b58edd4f582651fab22a77
Link:
https://www.unpac.me/results/cc5fa257-d04d-4cd5-9cc1-b3fd7ac99e76/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b4a3cafc8553/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b4a3cafc8553c06b17131e6b3afb38971312a4d91ae3349d2d118bdfc3d8de94

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe b4a3cafc8553c06b17131e6b3afb38971312a4d91ae3349d2d118bdfc3d8de94

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1902380/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1892559/
Cape
Cape
https://www.capesandbox.com/analysis/216506/

Comments