MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e6dff8475541ebddc1f0db47a311eb2c25581b7d5e62af8066d59c283114c2d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Adware.FileTour
Vendor detections: 12
| SHA256 hash: | e6dff8475541ebddc1f0db47a311eb2c25581b7d5e62af8066d59c283114c2d3 |
|---|---|
| SHA3-384 hash: | e9da31658320d83624c3a741c7261aaa666db1a47172defb342e0a245078fec3a38a2ecc6075ce7a6bd16c470f2d967f |
| SHA1 hash: | 0c745cd386c529d2f06d51e260fdca4b34ad0942 |
| MD5 hash: | ab378a91bd7a186c0eb724c264c836fb |
| humanhash: | one-table-arizona-diet |
| File name: | e6dff8475541ebddc1f0db47a311eb2c25581b7d5e62a.exe |
| Download: | download sample |
| Signature | Adware.FileTour |
| File size: | 6'344'930 bytes |
| First seen: | 2021-10-27 14:51:24 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | c9adc83b45e363b21cd6b11b5da0501f (82 x ArkeiStealer, 60 x RecordBreaker, 46 x RedLineStealer) |
| ssdeep | 196608:itjyxliX+dZegkxKbgyPu5q5fcKtvEglYtgt:sy7VdZegIKb4q1f3Yat |
| TLSH | T16D56332CE1C29971C1760A3B8C5BF7FBF13D620859BD76CEA7C91D8868533052EB6249 |
| File icon (PE): |  |
| dhash icon | b298acbab2ca7a72 (2'335 x GCleaner, 1'831 x Socks5Systemz, 67 x RedLineStealer) |
| Reporter |  abuse_ch |
| Tags: | Adware.FileTour exe |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 144.202.13.247:33577 | https://threatfox.abuse.ch/ioc/238428/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
266
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6609814701637632.zip
Verdict:
Malicious activity
Analysis date:
2021-10-27 12:41:31 UTC
Tags:
autoit trojan evasion rat redline stealer vidar opendir loader formbook smoke raccoon
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Delayed reading of the file
Creating a file in the %temp% subdirectories
Creating a file in the Program Files subdirectories
Deleting a recently created file
Creating a process from a recently created file
Creating a process with a hidden window
Running batch commands
Launching a process
Using the Windows Management Instrumentation requests
Searching for the window
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Replacing files
Creating a file in the Windows subdirectories
Launching a service
Launching a tool to kill processes
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
evasive fingerprint greyware overlay packed
Malware family:
RedLine stealer
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
phis.troj.adwa.spyw.evad
Score:
100 / 100
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Changes security center settings (notifications, updates, antivirus, firewall)
Changes the view of files in windows explorer (hidden files and folders)
Creates HTML files with .exe extension (expired dropper behavior)
Drops PE files with benign system names
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Modifies Chrome's extension installation force list
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Schedule system process
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Cerbu
Status:
Malicious
First seen:
2021-10-26 19:37:13 UTC
AV detection:
20 of 27 (74.07%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Result
Malware family:
vidar
Score:
10/10
Tags:
family:redline family:vidar botnet:1045 botnet:drakdong botnet:v4 discovery evasion infostealer spyware stealer trojan upx
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Script User-Agent
Runs ping.exe
Modifies system certificate store
Modifies registry class
Modifies data under HKEY_USERS
Kills process with taskkill
Creates scheduled task(s)
Checks SCSI registry key(s)
Program crash
Enumerates physical storage devices
Drops file in Windows directory
Drops file in Program Files directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops file in System32 directory
Enumerates connected drives
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks whether UAC is enabled
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Accesses 2FA software files, possible credential harvesting
Reads user/profile data of web browsers
Loads dropped DLL
Checks computer location settings
UPX packed file
Executes dropped EXE
Drops file in Drivers directory
Downloads MZ/PE file
Blocklisted process makes network request
Vidar Stealer
ACProtect 1.3x - 1.4x DLL software
Vidar
Suspicious use of NtCreateProcessExOtherParentProcess
RedLine Payload
RedLine
Modifies visiblity of hidden/system files in Explorer
Modifies visibility of file extensions in Explorer
Malware Config
C2 Extraction:
3.17.66.208:50383
https://mas.to/@lilocc
144.202.13.247:33577
https://mas.to/@lilocc
144.202.13.247:33577
Unpacked files
SH256 hash:
ec32b38e5ad5c285c1d6d8237341a99772709e8e4ea23db953d63ab8f078379c
MD5 hash:
ccf4a60623b784b084855d0468d76eab
SHA1 hash:
9419cc65a1bb70e8780f6da7cedd169eb333db88
SH256 hash:
666229757b0d7cde94f804d447cab99e20eab8b7bdc99ca8c2fa2de3a2d610f9
MD5 hash:
edad118fcd98e1796954ea4cebeae02e
SHA1 hash:
59ebd7107f7d422088865156ecfd338c63391a62
SH256 hash:
e6dff8475541ebddc1f0db47a311eb2c25581b7d5e62af8066d59c283114c2d3
MD5 hash:
ab378a91bd7a186c0eb724c264c836fb
SHA1 hash:
0c745cd386c529d2f06d51e260fdca4b34ad0942
Malware family:
CryptOne
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.