🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b60392d6a27b2d6d005cb4f8c507eddd339031e01c5e54560a5e4c63b252d862. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b60392d6a27b2d6d005cb4f8c507eddd339031e01c5e54560a5e4c63b252d862
SHA3-384 hash: afe69878fb2e32218c3284fb65ae6a2f1cd9f2d8f1a38d769bbab1ac8993fc00b114ccba7e42b537fadb1d90583aba79
SHA1 hash: 37be444d353c0b6f250d6b0cdf7491a0bc88d118
MD5 hash: 3304eed67f839a01511792be568a87f1
humanhash: item-twelve-delta-carolina
File name:3304eed67f839a01511792be568a87f1.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:245'248 bytes
First seen:2022-04-17 15:00:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 64cca9e1e2de2d3835f36bbdd76fe0c2 (6 x RedLineStealer)
ssdeep 6144:ErMTdqyfHKrcj2qyl/ZytXQLBuyXDQ9Mzm+4N+nvol:8MTvfqrcj2ktAcYNzT4N+v
TLSH T1C2349D01BA90D034F5B752F8497987ACB93EBEB15B2451CB62D527EA06387E1EC3131B
TrID 40.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.0% (.SCR) Windows screen saver (13101/52/3)
13.6% (.EXE) Win64 Executable (generic) (10523/12/4)
8.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon b2dacabecee6baa6 (148 x RedLineStealer, 145 x Stop, 100 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.150.103.38:40169

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
193.150.103.38:40169 https://threatfox.abuse.ch/ioc/520609/

Intelligence

File Origin
# of uploads :
1
# of downloads :
360
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/264213/
Detection(s):
Win.Packed.Zard-9944307-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Connecting to a non-recommended domain
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/14107/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/625c2bb3482f2f41cac44d6f/reports/bd86a742-6011-4ebb-a536-ee2cefac0ca9/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/06275911-80ba-46b5-86ae-e3040ee7fcc6
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/977915
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 610402 Sample: 62NwnPP7Cn.exe Startdate: 17/04/2022 Architecture: WINDOWS Score: 100 26 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->26 28 Multi AV Scanner detection for domain / URL 2->28 30 Found malware configuration 2->30 32 6 other signatures 2->32 6 62NwnPP7Cn.exe 2->6         started        9 sjdfdas 2->9         started        process3 signatures4 34 Detected unpacking (changes PE section rights) 6->34 36 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 6->36 38 Maps a DLL or memory area into another process 6->38 40 Creates a thread in another existing process (thread injection) 6->40 11 explorer.exe 2 6->11 injected 42 Multi AV Scanner detection for dropped file 9->42 44 Machine Learning detection for dropped file 9->44 46 Checks if the current machine is a virtual machine (disk enumeration) 9->46 process5 dnsIp6 20 zennclinic.com 11->20 22 spbdg.ru 91.189.114.20, 49747, 80 RU-CENTERRU Russian Federation 11->22 24 10 other IPs or domains 11->24 16 C:\Users\user\AppData\Roaming\sjdfdas, PE32 11->16 dropped 18 C:\Users\user\...\sjdfdas:Zone.Identifier, ASCII 11->18 dropped 48 System process connects to network (likely due to code injection or exploit) 11->48 50 Benign windows process drops PE files 11->50 52 Deletes itself after installation 11->52 54 Hides that the sample has been downloaded from the Internet (zone.identifier) 11->54 file7 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b60392d6a27b2d6d005cb4f8c507eddd339031e01c5e54560a5e4c63b252d862/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-04-13 00:35:17 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
32 of 41 (78.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wybzfvvcpmww2ac4wt4mkb7n3uzzampadrpfivqklzgghmss3bra._file
Verdict:
malicious
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/220417-sdwa2abdh8/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
SmokeLoader
Malware Config
C2 Extraction:
http://hanfinvest.at/upload/
http://phunilbeauty.com/upload/
http://spbdg.ru/upload/
http://tnt-az.com/upload/
http://casagenaro.com/upload/
http://girneotel.com/upload/
http://zennclinic.com/upload/
http://mordo.ru/forum/
http://piratia-life.ru/upload/
http://pkodev.net/upload/
Unpacked files
SH256 hash:
94b1a1928663783d55d18e068691d41fda717aec2b8c139cbeec537baf590cf1
MD5 hash:
dbe67324ed2ee469fb8cc030ffaa3448
SHA1 hash:
c99473f88d6e73360fe671ef0eb624b71b94315f
Link:
https://www.unpac.me/results/4406e376-7682-4e79-a7fa-7b91c1a37150/
SH256 hash:
b60392d6a27b2d6d005cb4f8c507eddd339031e01c5e54560a5e4c63b252d862
MD5 hash:
3304eed67f839a01511792be568a87f1
SHA1 hash:
37be444d353c0b6f250d6b0cdf7491a0bc88d118
Link:
https://www.unpac.me/results/4406e376-7682-4e79-a7fa-7b91c1a37150/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b60392d6a27b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b60392d6a27b2d6d005cb4f8c507eddd339031e01c5e54560a5e4c63b252d862

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/264213/

Comments