MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba799ae5ce92f94edd6f376115e7ea178dd058ba59c40ceae7820bc6c4bd787c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 13

Intelligence 13 IOCs 1 YARA File information Comments

SHA256 hash:	ba799ae5ce92f94edd6f376115e7ea178dd058ba59c40ceae7820bc6c4bd787c
SHA3-384 hash:	2bfb3e68f35ed222b6b14d1c4373c197c8192d2c5359e60ba78ecf9b62bfec369e79ba129a7d99c1c422d55870659b5f
SHA1 hash:	5f12a77eed13b4383ee1dffe7f06f8d072022b47
MD5 hash:	2e3d7893776c7b1ef7b7fea8822e7d64
humanhash:	grey-venus-shade-stream
File name:	2e3d7893776c7b1ef7b7fea8822e7d64.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	334'336 bytes
First seen:	2021-12-20 13:56:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	02ee6c54d3ab44fde3432ebbac068962 (4 x RedLineStealer, 2 x ArkeiStealer, 2 x Smoke Loader)
ssdeep	3072:TBN603ra5y1oOBMu/VKS5cNDvDmocK85erZd6BwVlwITpkXynQXa6STZHCeFSLhj:dYuMegS6HcK85ern3AITpkCoa6S90L
Threatray	6'607 similar samples on MalwareBazaar
TLSH	T120647D1076A0D035F5B716F85AB5D3B9AA3E7DE1AB2490CF12D52AEE56346D0EC3030B
File icon (PE):
dhash icon	25ec1370319b9b91 (13 x RedLineStealer, 13 x Smoke Loader, 6 x Amadey)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
62.182.156.187:56323

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
62.182.156.187:56323	https://threatfox.abuse.ch/ioc/277871/

Intelligence

File Origin

# of uploads :

# of downloads :

137

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/215472/

Detection(s):

Win.Malware.Sabsik-9916837-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Searching for synchronization primitives

DNS request

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Sending an HTTP GET request

Creating a file in the %temp% directory

Creating a process from a recently created file

Sending a custom TCP request

Running batch commands

Creating a process with a hidden window

Unauthorized injection to a recently created process

Query of malicious DNS domain

Unauthorized injection to a system process

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/2759/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

CheckCmdLine

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/61c08bb1ec6c6c14a9e524c6/reports/1eff9d21-a62e-4505-9d1c-a5b68ca52ddd/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/83a17d1e-9060-42bd-9c1a-d253170028bc

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/910287

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ba799ae5ce92f94edd6f376115e7ea178dd058ba59c40ceae7820bc6c4bd787c/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2021-12-20 13:57:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 28 (92.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xj4zvzoosl4u5xlpg5qrlz7kc6g5awf2lhcaz2xhqif4nrf5pb6a._file

Verdict:

malicious

RedLineStealer

4ceacab8838ebc7d516f6d9602f02beb7a76e277c058fa327e1b95250df99da5

RedLineStealer

806da24bb7316addcd17c9ea5794857b535269d57b4dd90a34532a1b9c4b4c6b

RedLineStealer

bdeedae6677fbee2c6d82d1f643fe179a3562c294413f7cbfbe61f46634e1311

RedLineStealer

ca6f0fad6894549a79754b9270cd58c91cc83ad78ed67acdb4c26b023a091e9f

RedLineStealer

d5e488a3b12ac3656c376de4323ecd5e1d5b61877ed6efa2f3d30be09cd197f2

RedLineStealer

+ 6'597 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:amadey family:arkei family:redline family:smokeloader family:tofsee family:xmrig botnet:1 botnet:install backdoor collection discovery evasion infostealer miner persistence spyware stealer suricata trojan

Link:

https://tria.ge/reports/211220-q89e2abdgm/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Creates scheduled task(s)

Delays execution with timeout.exe

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Program crash

Launches sc.exe

Drops file in System32 directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

Arkei Stealer Payload

XMRig Miner Payload

Amadey

Arkei

RedLine

RedLine Payload

SmokeLoader

Tofsee

Windows security bypass

suricata: ET MALWARE Amadey CnC Check-In

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

xmrig

Malware Config

C2 Extraction:

http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
mubrikych.top
oxxyfix.xyz
185.215.113.35/d2VxjasuwS/index.php
62.182.156.187:56323
86.107.197.138:38133