🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Tofsee


Vendor detections: 11


Intelligence 11 IOCs 5 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143
SHA3-384 hash: e32a0bebe856f216dcbf9c9ba5e0d3795dcf7644e5fbafe86a58d74508348117b1a81e8bb4974cebaea0502d90629bbf
SHA1 hash: c85b2f93e81da0d5759f195afdf91a645343fe5d
MD5 hash: 6cbf95206889d06445d284b862cf18bf
humanhash: wisconsin-uranus-don-charlie
File name:e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe
Download: download sample
Signature Tofsee
Create hunting rule
File size:294'400 bytes
First seen:2021-09-24 21:05:34 UTC
Last seen:2021-09-24 22:01:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 968069613992074265463fec272c56c9 (15 x RedLineStealer, 6 x RaccoonStealer, 2 x Tofsee)
ssdeep 3072:eeehXdEcXxTudjD4wBlFBF6SMoAu0ay/MMZuuwcwjnqwP1JkTp7jZbm5ejH:eeSXvhudjDNlFb6BomNxwj9P1JkhZj
Threatray 4'831 similar samples on MalwareBazaar
TLSH T14354AE2077E0C035F4B702FA59B997B9A92D7EB0AB3881CB62C516EA53746E4DC30357
File icon (PE):PE icon
dhash icon aad8ac9cc6a68ee0 (34 x RedLineStealer, 14 x RaccoonStealer, 11 x Smoke Loader)
Reporter abuse_ch
Tags:exe Tofsee


Avatar
abuse_ch
Tofsee C2:
http://185.163.204.37/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.163.204.37/ https://threatfox.abuse.ch/ioc/226142/
135.181.142.223:30397 https://threatfox.abuse.ch/ioc/226444/
178.132.3.103:80 https://threatfox.abuse.ch/ioc/226445/
65.21.231.57:60751 https://threatfox.abuse.ch/ioc/226446/
185.244.180.224:39957 https://threatfox.abuse.ch/ioc/226450/

Intelligence

File Origin
# of uploads :
2
# of downloads :
824
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-24 21:07:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cc30ad09-a9e9-4b9a-abb4-ad3579d32766

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/191284/
Detection(s):
SecuriteInfo.com.Ransom.Stop.Z5.10263.12451.UNOFFICIAL
Create hunting rule

Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/46cd9529-d0c7-430c-be2a-0f9deb9430ce
Result
Threat name:
RedLine SmokeLoader Tofsee
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/857658
Signature
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Benign windows process drops PE files
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade analysis by execution special instruction which cause usermode exception
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 490085 Sample: e3d023e5f6f2e7eebfb12204edd... Startdate: 24/09/2021 Architecture: WINDOWS Score: 100 72 t.me 2->72 74 jqueri-web.at 2->74 76 2 other IPs or domains 2->76 86 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->86 88 Multi AV Scanner detection for submitted file 2->88 90 Yara detected SmokeLoader 2->90 92 10 other signatures 2->92 11 e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe 2->11         started        14 bjiuhvs 2->14         started        16 svchost.exe 2->16         started        18 8 other processes 2->18 signatures3 process4 dnsIp5 124 Detected unpacking (changes PE section rights) 11->124 126 Contains functionality to inject code into remote processes 11->126 128 Injects a PE file into a foreign processes 11->128 21 e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe 11->21         started        130 Multi AV Scanner detection for dropped file 14->130 132 Machine Learning detection for dropped file 14->132 24 bjiuhvs 14->24         started        134 Changes security center settings (notifications, updates, antivirus, firewall) 16->134 26 MpCmdRun.exe 16->26         started        78 192.168.2.1 unknown unknown 18->78 signatures6 process7 signatures8 116 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 21->116 118 Maps a DLL or memory area into another process 21->118 120 Checks if the current machine is a virtual machine (disk enumeration) 21->120 122 Creates a thread in another existing process (thread injection) 21->122 28 explorer.exe 18 21->28 injected 33 conhost.exe 26->33         started        process9 dnsIp10 80 193.56.146.41, 49786, 9080 LVLT-10753US unknown 28->80 82 216.128.137.31, 49781, 80 AS-CHOOPAUS United States 28->82 84 3 other IPs or domains 28->84 64 C:\Users\user\AppData\Roaming\bjiuhvs, PE32 28->64 dropped 66 C:\Users\user\AppData\Local\Temp\7125.exe, PE32 28->66 dropped 68 C:\Users\user\AppData\Local\Temp\648E.exe, PE32 28->68 dropped 70 7 other malicious files 28->70 dropped 144 System process connects to network (likely due to code injection or exploit) 28->144 146 Benign windows process drops PE files 28->146 148 Deletes itself after installation 28->148 150 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->150 35 5096.exe 28->35         started        38 36E8.exe 28->38         started        40 58D5.exe 2 28->40         started        42 4 other processes 28->42 file11 signatures12 process13 file14 94 Detected unpacking (changes PE section rights) 35->94 96 Machine Learning detection for dropped file 35->96 98 Injects a PE file into a foreign processes 35->98 45 5096.exe 35->45         started        100 Multi AV Scanner detection for dropped file 38->100 102 Query firmware table information (likely to detect VMs) 38->102 104 Tries to detect sandboxes and other dynamic analysis tools (window names) 38->104 106 Tries to detect sandboxes / dynamic malware analysis system (registry check) 38->106 48 conhost.exe 38->48         started        108 Antivirus detection for dropped file 40->108 50 58D5.exe 2 40->50         started        52 conhost.exe 40->52         started        62 C:\Users\user\AppData\Local\...\xjebihhv.exe, PE32 42->62 dropped 110 Detected unpacking (overwrites its own PE header) 42->110 112 Tries to evade analysis by execution special instruction which cause usermode exception 42->112 114 Hides threads from debuggers 42->114 54 cmd.exe 42->54         started        56 conhost.exe 42->56         started        58 conhost.exe 42->58         started        signatures15 process16 signatures17 136 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 45->136 138 Maps a DLL or memory area into another process 45->138 140 Checks if the current machine is a virtual machine (disk enumeration) 45->140 142 Creates a thread in another existing process (thread injection) 45->142 60 conhost.exe 54->60         started        process18
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-09-24 21:06:08 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4pichzpw6lt65p5reico3u5mkjxigdwmauopx6p4t3je3doh2fbq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
17bff86e41d0cf2d0135bf9c1186db6c5434985db8b8375db0b472a2d92cd804
Tofsee
2232ded5541847acb7f73006ebe047b9008b4876f90590d9ffd324360f785037
Tofsee
39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b
Tofsee
6232bd70528f163b7aa8e8d76f6c4e63a0660eb112eabf2cc1859cc9e83ca755
Tofsee
843140b0a3f095d74fe2682d3ae029d4da70a5bae79850cf047a72c9d4a882c0
Tofsee
a98b37b337927ef6cea8a053a4ea676646de4dfbf6ce9619593246a1ecc362b6
Tofsee
ab52a71b3ffb4a0af77fb8d4bc687f9c296e20f78bac27e05e69ddd0e54446c7
Tofsee
e206cdfadd769d8506f7dde22b1a3277075506810b455f491ff08fd42707a0a0
Tofsee
f0757e949cad8233abf76b1a8ccc82a1a92a780b20e21bbe1a5a8bb03a4544a0
Tofsee
fd0abd76e63bfc430d03202558a055da8df0cde77765824a476491dba86ad2ab
Tofsee
+ 4'821 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:servhelper family:smokeloader family:tofsee family:xmrig botnet:2k superstar botnet:5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 botnet:700$ botnet:f6d7183c9e82d2a9b81e6c0608450aa66cefb51f botnet:qq backdoor discovery evasion infostealer miner persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/210924-zxq9raaaf3/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious behavior: LoadsDriver
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Runs net.exe
Modifies registry key
Modifies registry class
Modifies data under HKEY_USERS
Delays execution with timeout.exe
Creates scheduled task(s)
Checks SCSI registry key(s)
Enumerates physical storage devices
Launches sc.exe
Drops file in Windows directory
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops file in System32 directory
Checks whether UAC is enabled
Checks installed software on the system
Adds Run key to start application
Accesses cryptocurrency files/wallets, possible credential harvesting
Themida packer
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Loads dropped DLL
Drops startup file
Deletes itself
Checks BIOS information in registry
Sets service image path in registry
Sets DLL path for service in the registry
Modifies Windows Firewall
Modifies RDP port number used by Windows
Executes dropped EXE
Downloads MZ/PE file
Creates new service(s)
Blocklisted process makes network request
XMRig Miner Payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Grants admin privileges
xmrig
Windows security bypass
Tofsee
SmokeLoader
ServHelper
RedLine Payload
RedLine
Raccoon
Malware Config
C2 Extraction:
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
185.244.180.224:39957
135.181.142.223:30397
65.21.231.57:60751
Unpacked files
SH256 hash:
2fead9437f15e057951fd6a02ab05076e38db13483df0191787c21c79343b9e7
MD5 hash:
1c90f3a3fcd93ee08b2154cbcff49085
SHA1 hash:
73ac881633a13c3c31c1153d8105b8ecbb60961e
Link:
https://www.unpac.me/results/d132c625-21d7-4c38-9790-b045eb99e688/
SH256 hash:
e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143
MD5 hash:
6cbf95206889d06445d284b862cf18bf
SHA1 hash:
c85b2f93e81da0d5759f195afdf91a645343fe5d
Link:
https://www.unpac.me/results/d132c625-21d7-4c38-9790-b045eb99e688/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e3d023e5f6f2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/191284/

Comments