MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eac7ad1a557e26c8be44b8d3f223a764b07f346f8f7037df3614be67edeb644b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs 1 YARA File information Comments

SHA256 hash:	eac7ad1a557e26c8be44b8d3f223a764b07f346f8f7037df3614be67edeb644b
SHA3-384 hash:	6130905a92416b55a0f1d08e047bece7859f8ec3e71e6c5f2911f7f571d808cf9eb24dbdec4f87493faf30b1ad6b0279
SHA1 hash:	3c10db6900172813291079ed683c48f213b6cb55
MD5 hash:	1b404a2d8105239b41e8e009b84f35a2
humanhash:	hotel-march-march-spring
File name:	1b404a2d8105239b41e8e009b84f35a2.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	163'840 bytes
First seen:	2021-11-19 07:26:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f9127c363bcea23d1bd962e71624f505 (5 x RedLineStealer, 1 x Smoke Loader, 1 x ArkeiStealer)
ssdeep	1536:LMV7y4Jek3aqzT5IkQzkfszYHVeW//akAnCHTjAEuIiA6vJisN4A1Ma49spvAaXW:Q7y4gyXQzystm//vl6UiXGs6aXHl8
Threatray	2'645 similar samples on MalwareBazaar
TLSH	T19CF3AE2037F0D0B3F5E626301970BAA11ABAF9736633D58B3398962E1E703D05AB5757
File icon (PE):
dhash icon	fcfcb4f4d4d4d8c0 (19 x RedLineStealer, 16 x RaccoonStealer, 14 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
95.216.168.100:38784

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
95.216.168.100:38784	https://threatfox.abuse.ch/ioc/250769/

Intelligence

File Origin

# of uploads :

# of downloads :

141

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

1b404a2d8105239b41e8e009b84f35a2.exe

Verdict:

No threats detected

Analysis date:

2021-11-19 07:39:57 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/4e2d0742-2fc8-45e4-a84d-20927b325fcc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for synchronization primitives

DNS request

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Sending an HTTP POST request

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/619751c94912a8c920a37696/reports/811cc307-28ea-4355-af87-2f4c52bf945c/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4578b328-3bc6-4328-a6a0-ab268de9f0d2

Result

Threat name:

Clipboard Hijacker Raccoon RedLine Smoke

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/892484

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Delayed program exit found

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Clipboard Hijacker

Yara detected Raccoon Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eac7ad1a557e26c8be44b8d3f223a764b07f346f8f7037df3614be67edeb644b/

Threat name:

Win32.Backdoor.Mokes

Status:

Malicious

First seen:

2021-11-19 07:27:05 UTC

AV detection:

20 of 44 (45.45%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5ld22gsvpytmrpsexdj7ei5hmsyh6ndpr5ydpxzwcs7gp3plmrfq._file

Verdict:

malicious

RedLineStealer

305c0c524645f5fdebb135076c3c4411a03102c518385852860ea2120093c5f8

RedLineStealer

5dcbc7f0e894b1830f58e2449e85e4666a303594b18abd1c61e6614218ca5199

RedLineStealer

685737a7f8768d338bfb874c6922f655296d9063a4bd37d326a7da14e4594f4c

RedLineStealer

7163d47439cbab3397556ebda45e83fdea5dd01ce0fcfaae7ad18637a4433455

RedLineStealer

7dab1f684aec2df9de6144f4e14381245275e9d659152d5f40a437f1c1ec3758

RedLineStealer

ac8697711f5fa68084b2c122a9907ab845aff81592d4d1b86bb8d269357b66e2

RedLineStealer

d7cdfb895940efd584c78b7e56f9ed720491234df489ee9eb9aa98c24714d530

RedLineStealer

e4f04712d99435fd9e716a22af790ea6b58547beeb9089c71992e3f3f2ed0c73

RedLineStealer

fe3ae99417e0d632995ad5ceeccc4c0b308b8a30d2c93031f15837b607b8552b

RedLineStealer

+ 2'635 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/211119-h94beacfb4/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Deletes itself

Drops startup file

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://membro.at/upload/
http://jeevanpunetha.com/upload/
http://misipu.cn/upload/
http://zavodooo.ru/upload/
http://targiko.ru/upload/
http://vues3d.com/upload/