MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bdf85b4612cff5ef32b9bf0b451ef22705a5b9e70d1c4ded83f7123ebbcd3917. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs 1 YARA File information Comments

SHA256 hash:	bdf85b4612cff5ef32b9bf0b451ef22705a5b9e70d1c4ded83f7123ebbcd3917
SHA3-384 hash:	708a9eece162de6604b66864b74b6b03ce5599b6840c5d49659353e544d589af9ac3869ea0a35b2352957c0f5abeb76f
SHA1 hash:	8624145ae1b4e757aceefa1d86f8a5f535d3c41a
MD5 hash:	0acb306e33cd3a119a0d20ab67a1acb5
humanhash:	november-pluto-freddie-ack
File name:	0acb306e33cd3a119a0d20ab67a1acb5.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	310'784 bytes
First seen:	2022-05-22 09:10:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2be6f5e335599832250ce10d0c8ed52d (3 x RedLineStealer)
ssdeep	6144:5TS+Exoqzf5qAkxG/jJ2XuyaQPVP5mReq:5WFxb5qLG/jJCua5
Threatray	4'540 similar samples on MalwareBazaar
TLSH	T154646D00AA50F035F1F716F849BA92B8B529BDB1AB2450DB72D73AEE56346D0EC30717
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	9824e7d0c4e7215c (11 x RedLineStealer, 5 x Smoke Loader, 2 x RaccoonStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
141.255.161.70:81

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
141.255.161.70:81	https://threatfox.abuse.ch/ioc/623370/

Intelligence

File Origin

# of uploads :

# of downloads :

338

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

0acb306e33cd3a119a0d20ab67a1acb5.exe

Verdict:

No threats detected

Analysis date:

2022-05-22 09:11:59 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/49868a8e-a0ce-4a5a-a65a-6fed12ee8f05

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/273395/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending a UDP request

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/19513/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionQueryPerformanceCounter

CheckCmdLine

EvasionGetTickCount

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed smokeloader

Link:

https://www.filescan.io/uploads/6289fe283223462f89da84fe/reports/7c1b1320-ae2f-47bb-8dc6-a8ef8078530c/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/25afd4b0-307e-4e10-aac4-cf30d10e283a

Result

Threat name:

RedLine, SmokeLoader

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/999285

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to infect the boot sector

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bdf85b4612cff5ef32b9bf0b451ef22705a5b9e70d1c4ded83f7123ebbcd3917/

Threat name:

Win32.Trojan.DllCheck

Status:

Malicious

First seen:

2022-05-21 10:00:45 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 26 (92.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xx4fwrqsz7266mvzx4fukhxse4c2lophbuoe33md64jd5o6nhelq._file

Verdict:

malicious

RedLineStealer

1af8db0f539323bebdcd8e72afa8e3a65e8f3950b2c9b59c771187662da1aa1c

RedLineStealer

2ed02cabdb5f2d169cb838c2a79e1d64e7bc54f809aef2087fbc96ae1b822e70

RedLineStealer

4819ff853b534e12c7460dd478d5d60c236885e23338af9e60e42ef226b360de

RedLineStealer

a56ad78fbf9ab91c4fb8e1023d3e653d55b8dfa187cae517ef869c4d16022650

RedLineStealer

+ 4'530 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/220522-k5la5shed6/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://bahninfo.at/upload/
http://img4mobi.com/upload/
http://equix.ru/upload/
http://worldalltv.com/upload/
http://negarehgallery.com/upload/
http://lite-server.ru/upload/
http://piratia/su/upload/
http://go-piratia.ru/upload/
http://monsutiur4.com/
http://nusurionuy5ff.at/
http://moroitomo4.net/
http://susuerulianita1.net/
http://cucumbetuturel4.com/
http://nunuslushau.com/
http://linislominyt11.at/
http://luxulixionus.net/
http://lilisjjoer44.com/
http://nikogminut88.at/
http://limo00ruling.org/
http://mini55tunul.com/
http://samnutu11nuli.com/
http://nikogkojam.org/
https://ny-city-mall.com/search.php
https://fresh-cars.net/search.php