🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3f8d6b3e497471cc5e1526d59f7068f0655704f98dca59d79a77b81f1cb7fd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3f8d6b3e497471cc5e1526d59f7068f0655704f98dca59d79a77b81f1cb7fd5
SHA3-384 hash: 2ddbe31c3c179a14aaec28cd60c442d06f828c3e31bfb6599ea9b755db92e413d17f7e28cd18758494e6c0ffb3a764e6
SHA1 hash: 062e29d59604956a4cffd64fc81cd1c3f72b0ff3
MD5 hash: b8d2d644a3ac5df8af9b3aff803f3347
humanhash: lamp-eighteen-bacon-purple
File name:b8d2d644a3ac5df8af9b3aff803f3347.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:345'600 bytes
First seen:2021-10-29 13:27:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e522cb867082e04c7a4b61561f8516ce (11 x RaccoonStealer, 2 x RedLineStealer, 1 x Stop)
ssdeep 6144:NOTOeA4lwH4QNlDembw1wCuVB/cChQoyYtCv3ddx/W:NiOePwHjNlDePuVB/cChQoytjx/W
Threatray 5'201 similar samples on MalwareBazaar
TLSH T175747C00B7A1C034F5B212F859BA9279B93E7AB16B7494CF12E516EE4674AE0FC31317
File icon (PE):PE icon
dhash icon badacabecee6baa2 (28 x RedLineStealer, 19 x Stop, 13 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
http://194.180.174.181/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://194.180.174.181/ https://threatfox.abuse.ch/ioc/239344/

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Setup.exe
Verdict:
Malicious activity
Analysis date:
2021-10-29 13:27:11 UTC
Tags:
evasion trojan loader opendir rat redline stealer vidar
Link:
https://app.any.run/tasks/74891379-ed74-4a66-b451-b1fb6a250378

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.79361.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5e0dde47-5612-43de-9293-4c93c49dad63
Result
Threat name:
Raccoon SmokeLoader Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/879300
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
DLL reload attack detected
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Renames NTDLL to bypass HIPS
Sample uses process hollowing technique
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected AntiVM3
Yara detected Raccoon Stealer
Yara detected SmokeLoader
Yara detected Vidar
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 511734 Sample: SkB6zJ6H3N.exe Startdate: 29/10/2021 Architecture: WINDOWS Score: 100 72 telegalive.top 2->72 74 toptelete.top 2->74 76 3 other IPs or domains 2->76 98 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->98 100 Multi AV Scanner detection for domain / URL 2->100 102 Found malware configuration 2->102 104 15 other signatures 2->104 11 SkB6zJ6H3N.exe 2->11         started        13 cviueca 2->13         started        16 cviueca 2->16         started        signatures3 process4 signatures5 18 SkB6zJ6H3N.exe 11->18         started        122 Injects a PE file into a foreign processes 13->122 21 cviueca 13->21         started        124 Machine Learning detection for dropped file 16->124 126 Contains functionality to inject code into remote processes 16->126 23 cviueca 16->23         started        process6 signatures7 90 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 18->90 92 Maps a DLL or memory area into another process 18->92 94 Checks if the current machine is a virtual machine (disk enumeration) 18->94 25 explorer.exe 14 18->25 injected 96 Creates a thread in another existing process (thread injection) 21->96 process8 dnsIp9 84 sysaheu90.top 185.98.87.159, 49754, 49756, 49757 VM-HOSTINGRU Russian Federation 25->84 86 iyc.jelikob.ru 81.177.141.36, 443, 49797 RTCOMM-ASRU Russian Federation 25->86 88 8 other IPs or domains 25->88 56 C:\Users\user\AppData\Roaming\sfiueca, PE32 25->56 dropped 58 C:\Users\user\AppData\Roaming\eviueca, PE32 25->58 dropped 60 C:\Users\user\AppData\Roaming\cviueca, PE32 25->60 dropped 62 15 other malicious files 25->62 dropped 114 System process connects to network (likely due to code injection or exploit) 25->114 116 Benign windows process drops PE files 25->116 118 Deletes itself after installation 25->118 120 Hides that the sample has been downloaded from the Internet (zone.identifier) 25->120 30 192F.exe 1 25->30         started        34 69B5.exe 25->34         started        36 97A5.exe 25->36         started        38 4 other processes 25->38 file10 signatures11 process12 dnsIp13 64 C:\Users\user\AppData\Local\Temp\1105.tmp, PE32 30->64 dropped 128 Multi AV Scanner detection for dropped file 30->128 130 DLL reload attack detected 30->130 132 Detected unpacking (changes PE section rights) 30->132 148 3 other signatures 30->148 134 Machine Learning detection for dropped file 34->134 136 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 34->136 138 Maps a DLL or memory area into another process 34->138 41 97A5.exe 36->41         started        78 194.180.174.181, 49841, 49863, 80 MIVOCLOUDMD unknown 38->78 80 telegalive.top 38->80 82 4 other IPs or domains 38->82 66 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 38->66 dropped 68 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 38->68 dropped 70 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 38->70 dropped 140 Tries to harvest and steal browser information (history, passwords, etc) 38->140 142 Adds a directory exclusion to Windows Defender 38->142 144 Sample uses process hollowing technique 38->144 146 Injects a PE file into a foreign processes 38->146 44 AdvancedRun.exe 38->44         started        46 powershell.exe 38->46         started        48 RegSvcs.exe 38->48         started        50 AdvancedRun.exe 38->50         started        file14 signatures15 process16 signatures17 106 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 41->106 108 Maps a DLL or memory area into another process 41->108 110 Checks if the current machine is a virtual machine (disk enumeration) 41->110 112 Creates a thread in another existing process (thread injection) 41->112 52 AdvancedRun.exe 44->52         started        54 conhost.exe 46->54         started        process18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3f8d6b3e497471cc5e1526d59f7068f0655704f98dca59d79a77b81f1cb7fd5/
Threat name:
Win32.Trojan.Raccrypt
Create hunting rule
Status:
Malicious
First seen:
2021-10-29 13:28:06 UTC
AV detection:
16 of 27 (59.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yp4nnm7es5drzrpbkjwvt5ygr4dfk4cptdoklhlzu55yd4olp7kq._file
Verdict:
malicious
Similar samples:
562207163defcad653f4332b78ae7b6a9ff9c06b5be005e7f7da30420e788c53
RedLineStealer
669f274f18e59c1600104f77e4622c96b5eb3cc0add18625103346ce9177ea9c
RedLineStealer
7ccbf3b294594e8217e4ca62fae730624db9a300e388f3215570154cd00617dd
RedLineStealer
aed2ef2307581edfdc8ebb2342ff7b10e383a91b17512dcb4a2f49d1344af27d
RedLineStealer
b06b803c1a654849e7b0310b0b590ca574568ab9eba41858e8caaff5dbbeacba
RedLineStealer
f3fc38ead9aae7ffdb533c056bcc93f6db5cbf153ac9cd8673945535288af947
RedLineStealer
+ 5'191 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:djvu family:raccoon family:redline family:smokeloader family:vidar botnet:21321313 botnet:517 botnet:68e2d75238f7c69859792d206401b6bde2b2515c botnet:706 botnet:754 botnet:936 botnet:9b47742e621d3b0f1b0b79db6ed26e2c33328c05 botnet:safeinstaller botnet:z0rm1on agilenet backdoor collection discovery evasion infostealer persistence ransomware spyware stealer suricata trojan
Link:
https://tria.ge/reports/211029-qqnqlsabck/
Behaviour
outlook_win_path
outlook_office_path
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Modifies system certificate store
Kills process with taskkill
Delays execution with timeout.exe
Creates scheduled task(s)
Checks processor information in registry
Checks SCSI registry key(s)
Program crash
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks installed software on the system
Adds Run key to start application
Accesses cryptocurrency files/wallets, possible credential harvesting
Accesses Microsoft Outlook profiles
Accesses 2FA software files, possible credential harvesting
Windows security modification
Reads user/profile data of web browsers
Obfuscated with Agile.Net obfuscator
Modifies file permissions
Loads dropped DLL
Deletes itself
Executes dropped EXE
Downloads MZ/PE file
Vidar Stealer
Nirsoft
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
Windows security bypass
Vidar
Turns off Windows Defender SpyNet reporting
Suspicious use of NtCreateProcessExOtherParentProcess
SmokeLoader
RedLine Payload
RedLine
Raccoon
Djvu Ransomware
Detected Djvu ransomware
Malware Config
C2 Extraction:
http://xacokuo8.top/
http://hajezey1.top/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/
http://193.56.146.214/
https://193.56.146.214/
https://mas.to/@lilocc
93.115.20.139:28978
185.183.32.161:80
185.215.113.94:15564
https://mas.to/@xeroxxx
http://rlrz.org/lancer
Unpacked files
SH256 hash:
7504bf3fa2768578ecf547d7ad5ee704bb32a345726f4d6007e4905db82c873c
MD5 hash:
67832761c9fb6dcaa2caaa433aeef1e9
SHA1 hash:
1f40855c5efb001c8dff2d10e10b8c68d573d68f
Link:
https://www.unpac.me/results/e6b2704f-4345-4f77-b8e5-0149e7803e5c/
SH256 hash:
c3f8d6b3e497471cc5e1526d59f7068f0655704f98dca59d79a77b81f1cb7fd5
MD5 hash:
b8d2d644a3ac5df8af9b3aff803f3347
SHA1 hash:
062e29d59604956a4cffd64fc81cd1c3f72b0ff3
Link:
https://www.unpac.me/results/e6b2704f-4345-4f77-b8e5-0149e7803e5c/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c3f8d6b3e497/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c3f8d6b3e497471cc5e1526d59f7068f0655704f98dca59d79a77b81f1cb7fd5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe c3f8d6b3e497471cc5e1526d59f7068f0655704f98dca59d79a77b81f1cb7fd5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1719493/
  
Delivery method
Distributed via web download

Comments