MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de84340eef0ca9f002d25e7a0ffdc5be906a2b0852c728008b9ac6928c3e7259. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de84340eef0ca9f002d25e7a0ffdc5be906a2b0852c728008b9ac6928c3e7259
SHA3-384 hash: 49188afe5e47e65576898e80b91365e59255aff1ae03076f9114b34566ddcb764f02be8e2f58c329605583784dc9d8c8
SHA1 hash: 5ce6029b58adba6846310d034215a166223b2c4d
MD5 hash: 8e864284bad6e42876272f27404bc362
humanhash: ten-louisiana-indigo-tennis
File name:8e864284bad6e42876272f27404bc362.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:162'304 bytes
First seen:2021-11-22 15:56:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4c9a08f141f1c63f1818b2bea7a5a6e2 (4 x RedLineStealer, 2 x RaccoonStealer)
ssdeep 1536:Bu7wTIVhI+9a9jbMl0JeSAPRMkCnf/8Pl30Lo7hFD7Eh/fVYq4gKatCVhi+aGXjS:47xIYaaRPPU8PlPD7EfGq4D0oc+5Xj
Threatray 1'755 similar samples on MalwareBazaar
TLSH T19CF39C31F7F3C072D4E6653069B0CAAD1A3AB8F26671458F3359263E1E702D08A69777
File icon (PE):PE icon
dhash icon fcfcd4d4d4d4d8c8 (18 x RedLineStealer, 6 x ArkeiStealer, 5 x RaccoonStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.215.113.115:53803

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.215.113.115:53803 https://threatfox.abuse.ch/ioc/252096/

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8e864284bad6e42876272f27404bc362.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-22 18:47:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ad142d75-bbe9-4b5f-aec1-a8092690c7f9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.Packed-GEE8E864284BAD6.25426.20772.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Searching for synchronization primitives
Sending a custom TCP request
Searching for analyzing tools
Launching a process
Launching the process to change the firewall settings
Unauthorized injection to a recently created process
Query of malicious DNS domain
Unauthorized injection to a recently created process by context flags manipulation
Sending a TCP request to an infection source
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/619bbdd0398e2553d200f4ae/reports/6f322ab6-73c7-4968-833d-54086c13f6d7/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8bc65c6c-d711-4971-a6b9-e68b571073bf
Result
Threat name:
RedLine SmokeLoader Tofsee
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/893993
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Query firmware table information (likely to detect VMs)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 526467 Sample: wj1j21cmxi.exe Startdate: 22/11/2021 Architecture: WINDOWS Score: 100 83 srtuiyhuali.at 2->83 85 quadoil.ru 2->85 87 3 other IPs or domains 2->87 123 Antivirus detection for URL or domain 2->123 125 Antivirus detection for dropped file 2->125 127 Multi AV Scanner detection for dropped file 2->127 129 16 other signatures 2->129 11 wj1j21cmxi.exe 2->11         started        14 kdykodo.exe 2->14         started        16 ucagvat 2->16         started        18 4 other processes 2->18 signatures3 process4 signatures5 141 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 11->141 20 wj1j21cmxi.exe 11->20         started        143 Detected unpacking (changes PE section rights) 14->143 145 Detected unpacking (overwrites its own PE header) 14->145 147 Writes to foreign memory regions 14->147 151 2 other signatures 14->151 23 svchost.exe 14->23         started        149 Machine Learning detection for dropped file 16->149 26 ucagvat 16->26         started        process6 dnsIp7 131 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 20->131 133 Maps a DLL or memory area into another process 20->133 135 Checks if the current machine is a virtual machine (disk enumeration) 20->135 28 explorer.exe 10 20->28 injected 89 quadoil.ru 85.143.175.153, 443, 49830, 49865 TRADERSOFTRU Russian Federation 23->89 91 microsoft-com.mail.protection.outlook.com 40.93.207.0, 25, 49814 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 23->91 93 192.168.2.1 unknown unknown 23->93 137 System process connects to network (likely due to code injection or exploit) 23->137 139 Creates a thread in another existing process (thread injection) 26->139 signatures8 process9 dnsIp10 95 192.162.246.70, 49767, 80 DATACHEAP-LLC-ASRU Russian Federation 28->95 97 216.128.137.31, 443, 49751, 49752 AS-CHOOPAUS United States 28->97 99 7 other IPs or domains 28->99 71 C:\Users\user\AppData\Roaming\ucagvat, PE32 28->71 dropped 73 C:\Users\user\AppData\Local\Temp\C375.exe, PE32 28->73 dropped 75 C:\Users\user\AppData\Local\Temp\A5BB.exe, PE32 28->75 dropped 77 6 other malicious files 28->77 dropped 153 System process connects to network (likely due to code injection or exploit) 28->153 155 Benign windows process drops PE files 28->155 157 Deletes itself after installation 28->157 159 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->159 33 8B5C.exe 4 28->33         started        37 6833.exe 2 28->37         started        40 A5BB.exe 2 28->40         started        42 2 other processes 28->42 file11 signatures12 process13 dnsIp14 79 45.9.20.149, 10844, 49845 DEDIPATH-LLCUS Russian Federation 33->79 101 Multi AV Scanner detection for dropped file 33->101 103 Detected unpacking (changes PE section rights) 33->103 105 Query firmware table information (likely to detect VMs) 33->105 121 3 other signatures 33->121 67 C:\Users\user\AppData\Local\...\kdykodo.exe, PE32 37->67 dropped 107 Detected unpacking (overwrites its own PE header) 37->107 109 Machine Learning detection for dropped file 37->109 111 Uses netsh to modify the Windows network and firewall settings 37->111 113 Modifies the windows firewall 37->113 44 cmd.exe 1 37->44         started        47 cmd.exe 2 37->47         started        49 sc.exe 1 37->49         started        55 2 other processes 37->55 115 Antivirus detection for dropped file 40->115 117 Injects a PE file into a foreign processes 40->117 51 conhost.exe 40->51         started        81 cdn.discordapp.com 42->81 119 Contains functionality to inject code into remote processes 42->119 53 8E0B.exe 42->53         started        file15 signatures16 process17 file18 69 C:\Windows\SysWOW64\...\kdykodo.exe (copy), PE32 44->69 dropped 57 conhost.exe 44->57         started        59 conhost.exe 47->59         started        61 conhost.exe 49->61         started        63 conhost.exe 55->63         started        65 conhost.exe 55->65         started        process19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de84340eef0ca9f002d25e7a0ffdc5be906a2b0852c728008b9ac6928c3e7259/
Threat name:
Win32.Trojan.Lockbit
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 15:57:09 UTC
File Type:
PE (Exe)
Extracted files:
16
AV detection:
36 of 45 (80.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=32cdidxpbsu7aawslz5a77ofx2igukyikldsqaeltldjfdb6ojmq._file
Verdict:
malicious
Similar samples:
1d1ad9014ce8356b997ff90266f50fb3314d7135e4cc9832128ebfa49f5b8aec
RedLineStealer
20363f9d72c4503b4fa41bcbc0e69b62b2e05e4878ce6fe443f0a488f0777fef
RedLineStealer
31f252898ace9fc5e4bccf183ef98c71a3f583dbfd637a64642c74e0490f5446
RedLineStealer
6f9c881d55ee853803be5f29c249ea49c498e65312c9eb95739727084d19644e
RedLineStealer
8466ebd35658644d4c289191e1341b8900bb021196fae0b82fbba7d8a74a3073
RedLineStealer
98c7b1a7626c14161e352f06407631aea8221bc95ca5fa4c08e0ebc8d8b9c9f2
RedLineStealer
e7d90e82ce6b6d2233f2afd0cbd1d7256497d5c4020b903d40a25b153dc9cfb5
RedLineStealer
+ 1'745 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:arkei family:redline family:smokeloader family:tofsee family:vidar family:xmrig botnet:706 botnet:@123 botnet:default agilenet backdoor collection discovery evasion infostealer miner persistence spyware stealer suricata trojan
Link:
https://tria.ge/reports/211122-tdxdrsfhdr/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Deletes itself
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Reads user/profile data of web browsers
Windows security modification
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Arkei Stealer Payload
Nirsoft
Vidar Stealer
XMRig Miner Payload
Arkei
RedLine
RedLine Payload
SmokeLoader
Tofsee
Vidar
Windows security bypass
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
xmrig
Malware Config
C2 Extraction:
http://host-file-host6.com/
http://host-host-file8.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
quadoil.ru
lakeflex.ru
185.159.80.90:38637
http://file-file-host4.com/tratata.php
141.95.82.50:63652
https://mastodon.online/@valhalla
https://koyu.space/@valhalla
Unpacked files
SH256 hash:
23554c8f1f1fd1e04a9c7053680f186fdbb61155942430095e76bb88552ad78b
MD5 hash:
5e2aad3c6e39abb50541d91e9591b22b
SHA1 hash:
97bb348f06b2ce6fdc5291420c537358e2259a9c
Link:
https://www.unpac.me/results/30ef6982-ad37-48a9-b9c1-62b37ee1844f/
SH256 hash:
de84340eef0ca9f002d25e7a0ffdc5be906a2b0852c728008b9ac6928c3e7259
MD5 hash:
8e864284bad6e42876272f27404bc362
SHA1 hash:
5ce6029b58adba6846310d034215a166223b2c4d
Link:
https://www.unpac.me/results/30ef6982-ad37-48a9-b9c1-62b37ee1844f/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/de84340eef0c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/de84340eef0ca9f002d25e7a0ffdc5be906a2b0852c728008b9ac6928c3e7259

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe de84340eef0ca9f002d25e7a0ffdc5be906a2b0852c728008b9ac6928c3e7259

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1800988/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/208261/

Comments