MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7ade306aef9c2756f3c15c7220b7eb7c89606cf6b413b7218d1350f36c2f795. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 18


Intelligence 18 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7ade306aef9c2756f3c15c7220b7eb7c89606cf6b413b7218d1350f36c2f795
SHA3-384 hash: f922a18352dd4c3f5fed8cfbf1c7f9fbfc6bc60049faedb12b279b58e8396b7f4e4b7f93328b07f6f4b3a89bfe4ab95b
SHA1 hash: 927abade9be3fbb96addc310ac27403c59d54692
MD5 hash: 03003f5ad43e4bfdf530a943fd27faf6
humanhash: freddie-idaho-white-ink
File name:03003f5ad43e4bfdf530a943fd27faf6.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:1'629'184 bytes
First seen:2023-10-26 17:25:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 24576:YyBCcqNrUSIyxljq0nVc4XTgJG+sVv78RkYBDUui00xcM7sUt/qi7n:fAjNrPvxlj3V/TgJKVvqrDU1cS75
TLSH T118752312AAE98837DA322B7135F353D35B7ABC942CB4936F4244699D0CB2740D83B767
TrID 70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:exe recordbreaker


Avatar
abuse_ch
RecordBreaker C2:
http://31.192.237.75/

Intelligence

File Origin
# of uploads :
1
# of downloads :
363
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
bus50.bin.zip
Verdict:
Malicious activity
Analysis date:
2023-10-26 23:31:57 UTC
Tags:
stealc stealer sinkhole redline trojan amadey botnet
Link:
https://app.any.run/tasks/f2629853-cba2-4331-a4c8-6865e71778b3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/456586/
Detection(s):
Sanesecurity.Malware.28840.BadO.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Launching a process
Launching a service
Сreating synchronization primitives
Creating a file
Creating a window
Launching cmd.exe command interpreter
Searching for synchronization primitives
Running batch commands
Adding an access-denied ACE
Forced system process termination
Forced shutdown of a system process
Blocking the Windows Defender launch
Disabling the operating system update service
Sending a TCP request to an infection source
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Gathering data
Verdict:
Malicious
Threat level:
  5/10
Confidence:
100%
Tags:
advpack anti-vm CAB control explorer installer installer lolbin packed rundll32 setupapi sfx shell32
Link:
https://www.filescan.io/uploads/653aa12d798f2840e4d247a8/reports/d5af989a-bfd1-4db3-8b9a-0c84779ca238/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/e7ade306aef9c2756f3c15c7220b7eb7c89606cf6b413b7218d1350f36c2f795
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/406fe240-c726-4c24-b9cd-485fbcc47a94
Result
Threat name:
Amadey, Babadeda, Mystic Stealer, RedLin
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1332856
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies windows update settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Amadey bot
Yara detected Amadeys Clipper DLL
Yara detected Amadeys stealer DLL
Yara detected Babadeda
Yara detected Mystic Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1332856 Sample: ioWcYn4G5B.exe Startdate: 26/10/2023 Architecture: WINDOWS Score: 100 201 Found malware configuration 2->201 203 Malicious sample detected (through community Yara rule) 2->203 205 Antivirus detection for URL or domain 2->205 207 19 other signatures 2->207 14 ioWcYn4G5B.exe 1 4 2->14         started        17 svchost.exe 2->17         started        process3 dnsIp4 149 C:\Users\user\AppData\Local\...\eE7fl39.exe, PE32 14->149 dropped 151 C:\Users\user\AppData\Local\...\7UI9NS48.exe, PE32 14->151 dropped 20 eE7fl39.exe 1 4 14->20         started        163 69.192.108.161 AKAMAI-ASUS United States 17->163 165 127.0.0.1 unknown unknown 17->165 file5 process6 file7 121 C:\Users\user\AppData\Local\...\iM8ux51.exe, PE32 20->121 dropped 123 C:\Users\user\AppData\Local\...\6pR7qu0.exe, PE32 20->123 dropped 213 Antivirus detection for dropped file 20->213 215 Machine Learning detection for dropped file 20->215 24 iM8ux51.exe 1 4 20->24         started        28 6pR7qu0.exe 20->28         started        signatures8 process9 file10 133 C:\Users\user\AppData\Local\...\Qh7MF36.exe, PE32 24->133 dropped 135 C:\Users\user\AppData\Local\...\5IC7BK3.exe, PE32 24->135 dropped 233 Antivirus detection for dropped file 24->233 235 Multi AV Scanner detection for dropped file 24->235 237 Machine Learning detection for dropped file 24->237 30 Qh7MF36.exe 1 4 24->30         started        34 5IC7BK3.exe 24->34         started        signatures11 process12 file13 153 C:\Users\user\AppData\Local\...\hR2HA86.exe, PE32 30->153 dropped 155 C:\Users\user\AppData\Local\...\4hp395iK.exe, PE32 30->155 dropped 267 Antivirus detection for dropped file 30->267 269 Machine Learning detection for dropped file 30->269 36 hR2HA86.exe 1 4 30->36         started        40 4hp395iK.exe 30->40         started        157 C:\Users\user\AppData\Local\...\explothe.exe, PE32 34->157 dropped 271 Multi AV Scanner detection for dropped file 34->271 42 explothe.exe 34->42         started        signatures14 process15 dnsIp16 125 C:\Users\user\AppData\Local\...\RR6lV79.exe, PE32 36->125 dropped 127 C:\Users\user\AppData\Local\...\3mj03zM.exe, PE32 36->127 dropped 217 Antivirus detection for dropped file 36->217 219 Machine Learning detection for dropped file 36->219 45 3mj03zM.exe 36->45         started        48 RR6lV79.exe 1 4 36->48         started        221 Writes to foreign memory regions 40->221 223 Allocates memory in foreign processes 40->223 225 Injects a PE file into a foreign processes 40->225 51 AppLaunch.exe 40->51         started        173 77.91.124.1 ECOTEL-ASRU Russian Federation 42->173 129 C:\Users\user\AppData\Roaming\...\clip64.dll, PE32 42->129 dropped 131 C:\Users\user\AppData\Local\...\clip64[1].dll, PE32 42->131 dropped 227 Multi AV Scanner detection for dropped file 42->227 229 Creates an undocumented autostart registry key 42->229 231 Uses schtasks.exe or at.exe to add and modify task schedules 42->231 54 cmd.exe 42->54         started        56 schtasks.exe 42->56         started        58 rundll32.exe 42->58         started        file17 signatures18 process19 dnsIp20 239 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 45->239 241 Maps a DLL or memory area into another process 45->241 243 Checks if the current machine is a virtual machine (disk enumeration) 45->243 245 Creates a thread in another existing process (thread injection) 45->245 60 explorer.exe 68 29 45->60 injected 113 C:\Users\user\AppData\Local\...\2XV4710.exe, PE32 48->113 dropped 115 C:\Users\user\AppData\Local\...\1uH81AL2.exe, PE32 48->115 dropped 247 Multi AV Scanner detection for dropped file 48->247 65 1uH81AL2.exe 48->65         started        67 2XV4710.exe 48->67         started        167 77.91.124.86 ECOTEL-ASRU Russian Federation 51->167 249 Found many strings related to Crypto-Wallets (likely being stolen) 51->249 69 conhost.exe 54->69         started        71 cmd.exe 54->71         started        73 cacls.exe 54->73         started        77 4 other processes 54->77 75 conhost.exe 56->75         started        file21 signatures22 process23 dnsIp24 175 5.42.65.80 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 60->175 177 77.91.68.249 FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU Russian Federation 60->177 179 3 other IPs or domains 60->179 137 C:\Users\user\AppData\Local\Temp\AE96.exe, PE32+ 60->137 dropped 139 C:\Users\user\AppData\Local\Temp\815B.exe, PE32 60->139 dropped 141 C:\Users\user\AppData\Local\Temp\7459.exe, PE32 60->141 dropped 143 8 other malicious files 60->143 dropped 251 System process connects to network (likely due to code injection or exploit) 60->251 253 Benign windows process drops PE files 60->253 79 32B4.exe 60->79         started        83 4024.exe 60->83         started        85 4313.exe 60->85         started        96 4 other processes 60->96 255 Contains functionality to inject code into remote processes 65->255 257 Writes to foreign memory regions 65->257 259 Allocates memory in foreign processes 65->259 87 AppLaunch.exe 9 1 65->87         started        89 AppLaunch.exe 65->89         started        91 AppLaunch.exe 65->91         started        261 Injects a PE file into a foreign processes 67->261 93 AppLaunch.exe 12 67->93         started        file25 signatures26 process27 dnsIp28 159 C:\Users\user\AppData\Local\...\Bd0pm0rt.exe, PE32 79->159 dropped 161 C:\Users\user\AppData\Local\...\6Nt70ww.exe, PE32 79->161 dropped 183 Antivirus detection for dropped file 79->183 185 Machine Learning detection for dropped file 79->185 98 Bd0pm0rt.exe 79->98         started        187 Multi AV Scanner detection for dropped file 83->187 189 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 83->189 191 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 83->191 193 Tries to harvest and steal browser information (history, passwords, etc) 83->193 195 Modifies windows update settings 87->195 197 Disable Windows Defender notifications (registry) 87->197 199 Disable Windows Defender real time protection (registry) 87->199 181 193.233.255.73 FREE-NET-ASFREEnetEU Russian Federation 93->181 102 chrome.exe 96->102         started        105 chrome.exe 96->105         started        107 conhost.exe 96->107         started        file29 signatures30 process31 dnsIp32 117 C:\Users\user\AppData\Local\...\wk5BM6EZ.exe, PE32 98->117 dropped 119 C:\Users\user\AppData\Local\...\5hT35pg.exe, PE32 98->119 dropped 209 Antivirus detection for dropped file 98->209 211 Machine Learning detection for dropped file 98->211 109 wk5BM6EZ.exe 98->109         started        169 192.168.2.5 unknown unknown 102->169 171 239.255.255.250 unknown Reserved 102->171 file33 signatures34 process35 file36 145 C:\Users\user\AppData\Local\...\Rj7oK9Zm.exe, PE32 109->145 dropped 147 C:\Users\user\AppData\Local\...\4WA329QL.exe, PE32 109->147 dropped 263 Antivirus detection for dropped file 109->263 265 Machine Learning detection for dropped file 109->265 signatures37
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e7ade306aef9c2756f3c15c7220b7eb7c89606cf6b413b7218d1350f36c2f795
Detection:
redlinestealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e7ade306aef9c2756f3c15c7220b7eb7c89606cf6b413b7218d1350f36c2f795/
Threat name:
Win32.Trojan.Stealerc
Create hunting rule
Status:
Malicious
First seen:
2023-10-26 17:26:06 UTC
File Type:
PE (Exe)
Extracted files:
227
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=46w6gbvo7hbhk3z4cxdsec36w7ejmbwpnnatw4qy2e2q6nwc66kq._file
Verdict:
malicious
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:dcrat family:glupteba family:raccoon family:redline family:smokeloader family:zgrat botnet:6a6a005b9aa778f606280c5fa24ae595 botnet:@ytlogsbot botnet:grome botnet:kinza botnet:up3 backdoor brand:microsoft discovery dropper evasion infostealer loader persistence phishing rat stealer trojan upx
Link:
https://tria.ge/reports/231026-vzt17sfa79/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Program crash
Checks for VirtualBox DLLs, possible anti-VM trick
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Detected potential entity reuse from brand microsoft.
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
UPX packed file
Windows security modification
Blocklisted process makes network request
Downloads MZ/PE file
Drops file in Drivers directory
Modifies Windows Firewall
Stops running service(s)
Amadey
DcRat
Detect ZGRat V1
Glupteba
Glupteba payload
Modifies Windows Defender Real-time Protection settings
Raccoon
Raccoon Stealer payload
RedLine
RedLine payload
SmokeLoader
Suspicious use of NtCreateUserProcessOtherParentProcess
ZGRat
Malware Config
C2 Extraction:
http://77.91.68.29/fks/
77.91.124.86:19084
http://77.91.124.1/theme/index.php
http://host-file-host6.com/
http://host-host-file8.com/
http://195.123.218.98:80
http://31.192.23
194.169.175.235:42691
Unpacked files
SH256 hash:
160ea596dea538000394fde4ba2d40fd2be5ab50037a77ba3000e927bff84ef1
MD5 hash:
22b50c95b39cbbdb00d5a4cd3d4886bd
SHA1 hash:
db8326c4fad0064ce3020226e8556e7cce8ce04e
Link:
https://www.unpac.me/results/6756075b-f404-40e4-86ee-cf83954d94d2/
Parent samples :
24b66c0d6f26f5de09b4cb7a2496bf87ad0ed9d45e846870dee70941b565bc3c
d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200
SH256 hash:
b615de264a4caed2078cd65ef8343784e64cd5610f4c1bca116a5aeb0e7da54a
MD5 hash:
d41c5f5219f67587be6376601b87b8e5
SHA1 hash:
6d0011ad2e2e7313d1bf28a2484daf8456072b64
Link:
https://www.unpac.me/results/6756075b-f404-40e4-86ee-cf83954d94d2/
SH256 hash:
d7bb9098274dd08ffb8c5ac8c89b21f2371a90a163a8c0badae0443319d031cf
MD5 hash:
b07a33310d38e46391649df79dd7b38e
SHA1 hash:
09447c01452cc28aab3b1abba78ce18ab7f1427b
Detections:
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/6756075b-f404-40e4-86ee-cf83954d94d2/
Parent samples :
956f6f133ca7281fef1f94d9e57857915927b527e2d4b3badcf364c4fa8153fb
6fb8cbfcc0237e85d47902eb39dcf6bd9a706e9030e8e208850fd985b5a4468d
e7ade306aef9c2756f3c15c7220b7eb7c89606cf6b413b7218d1350f36c2f795
SH256 hash:
5e038a9d036592dd3ee1b2102cd726d0cd2085945616e208aae4b2e397db78eb
MD5 hash:
fe4841aef0e10f47a52f8ba607e27c85
SHA1 hash:
a6cbf81bdaa5d166d643cbe64b2291c4dd1a6453
Detections:
Amadey
Create hunting rule
win_amadey_auto
Create hunting rule
Link:
https://www.unpac.me/results/6756075b-f404-40e4-86ee-cf83954d94d2/
Parent samples :
e7ade306aef9c2756f3c15c7220b7eb7c89606cf6b413b7218d1350f36c2f795
159ae7a37292dc5f373b76bcf7570cf4c58ae78178faaf8e2a41813d312996a5
SH256 hash:
6871370b9134497b2cc69c03693c26616e1b7b4b602dae76ae1192043d1fbb83
MD5 hash:
5676f252308635f736b9fe5974567d25
SHA1 hash:
7fbdc167a23c7074c386aa0bed25393be403e411
Link:
https://www.unpac.me/results/6756075b-f404-40e4-86ee-cf83954d94d2/
SH256 hash:
f95b1e3c04c3691448fe966707552b2ecd2edd44936a174189c3388040989c98
MD5 hash:
fb5b640e0b4a53f89d1dc1b91379d43d
SHA1 hash:
b39f02e42a8d56999ce3375884dea0a0fdda9cac
Link:
https://www.unpac.me/results/6756075b-f404-40e4-86ee-cf83954d94d2/
SH256 hash:
e7ade306aef9c2756f3c15c7220b7eb7c89606cf6b413b7218d1350f36c2f795
MD5 hash:
03003f5ad43e4bfdf530a943fd27faf6
SHA1 hash:
927abade9be3fbb96addc310ac27403c59d54692
Link:
https://www.unpac.me/results/6756075b-f404-40e4-86ee-cf83954d94d2/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e7ade306aef9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe e7ade306aef9c2756f3c15c7220b7eb7c89606cf6b413b7218d1350f36c2f795

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2722824/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/456586/

Comments