MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd897b933617680b7ec6fb5ef77fd8f03a3ac2804fba3601231cb29dcca95f7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 13

Intelligence 13 IOCs 1 YARA File information Comments

SHA256 hash:	bd897b933617680b7ec6fb5ef77fd8f03a3ac2804fba3601231cb29dcca95f7e
SHA3-384 hash:	176ef88454b99755962577f70d4938742b11c95aaa8b362ad13d978055f6767deae83f2eae5066acca0ad1d02237c0c2
SHA1 hash:	cb749bd9b20896b9b879dab534e163891858271f
MD5 hash:	2cc70834624f85f5dd83b987ea57c234
humanhash:	north-rugby-magnesium-glucose
File name:	2cc70834624f85f5dd83b987ea57c234.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	157'696 bytes
First seen:	2021-12-17 21:06:22 UTC
Last seen:	2021-12-17 23:07:42 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	085d4aa5e29579ffcd8f5171fcc76b83 (2 x RedLineStealer, 1 x CryptBot, 1 x Amadey)
ssdeep	3072:WLu6wkIGMOWSqjz4CBILYk4wkEjNmmo2zmTWrxpzbgqruAH2yqbB:WLu5FO9WzvIclU6HTuzbgwuXvB
Threatray	9'636 similar samples on MalwareBazaar
TLSH	T15BF3BF3136ECC9F2C5A716F044649AD45E7AF8222660524B3758166E3F74FCC4AF236E
File icon (PE):
dhash icon	4839b234e8c38890 (121 x RaccoonStealer, 54 x RedLineStealer, 51 x ArkeiStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
193.38.55.60:11329

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
193.38.55.60:11329	https://threatfox.abuse.ch/ioc/277016/

Intelligence

File Origin

# of uploads :

# of downloads :

216

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/214889/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.6031.26022.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

DNS request

Sending a custom TCP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Creating a file in the %temp% directory

Creating a process from a recently created file

Searching for the window

Searching for analyzing tools

Query of malicious DNS domain

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Sending an HTTP GET request to an infection source

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/2410/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

CPUID_Instruction

CheckCmdLine

EvasionGetTickCount

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/61bcfbf9a2eae65b861fce22/reports/56cdbed0-dd26-467c-892a-241e0d594ff9/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7b82984c-b8b6-4284-a527-b6852a69785e

Result

Threat name:

BazaLoader RedLine SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/909346

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file has nameless sections

Query firmware table information (likely to detect VMs)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade analysis by execution special instruction which cause usermode exception

Yara detected BazaLoader

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bd897b933617680b7ec6fb5ef77fd8f03a3ac2804fba3601231cb29dcca95f7e/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2021-12-17 21:07:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 28 (92.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xwexxezwc5uaw7wg7nppo76y6a5dvquaj65dmajddszj3tfjl57a._file

Verdict:

malicious

RedLineStealer

51292123be465090e62adc0b27f651b4b798eb0dda7909ac180a00a9a4c4aa42

RedLineStealer

6d960492cd435b33c4a7e80919cdbbb15826b8931fef1700273a25ee203d4777

RedLineStealer

89e3edba103dda1e75df808efd852f8ef30333aa874a4af6b8de8ff2b69244c7

RedLineStealer

9472007a377f85bc908161a924be7bee4e9ffbca29ddea6131eddd2c99af3e86

RedLineStealer

9b1f043a6551ef0fa8ba27fb9707b11c01332f1ad0e37ae03eadb13aaae2a7a3

RedLineStealer

+ 9'626 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:amadey family:arkei family:bazarloader family:redline family:smokeloader family:tofsee family:vidar family:warzonerat family:xmrig botnet:1 botnet:1100 backdoor collection discovery dropper evasion infostealer loader miner persistence rat spyware stealer suricata trojan

Link:

https://tria.ge/reports/211217-zyay6afabl/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Creates scheduled task(s)

Delays execution with timeout.exe

Kills process with taskkill

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Launches sc.exe

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Maps connected drives based on registry

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Looks for VMWare Tools registry key

Modifies Windows Firewall

Sets service image path in registry

Arkei Stealer Payload

Bazar/Team9 Loader payload

Looks for VirtualBox Guest Additions in registry

Nirsoft

Vidar Stealer

Warzone RAT Payload

XMRig Miner Payload

Amadey

Arkei

Bazar Loader

RedLine

RedLine Payload

SmokeLoader

Tofsee

Vidar

WarzoneRat, AveMaria

Windows security bypass

suricata: ET MALWARE Amadey CnC Check-In

suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

xmrig

Malware Config

C2 Extraction:

http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
86.107.197.138:38133
mubrikych.top
oxxyfix.xyz
https://noc.social/@sergeev46
https://c.im/@sergeev47
185.215.113.35/d2VxjasuwS/index.php