MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fab15b7f61f816cf3128cc02c96d98d3385533087bc5afe3cd3799e7e034ce7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fab15b7f61f816cf3128cc02c96d98d3385533087bc5afe3cd3799e7e034ce7f
SHA3-384 hash: 7b24afdbca4ee8731fb12f2fc7152f1534cad00220ac61a004f5693f5ff3975c6e959c4b989b2c81bb4545e4d9c7ed2a
SHA1 hash: 056c5c26f208e5772e9f67b77389f989c44e1933
MD5 hash: 9c477095786e3f993a820863dfe8a799
humanhash: dakota-east-one-triple
File name:9c477095786e3f993a820863dfe8a799.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:269'312 bytes
First seen:2021-10-02 10:40:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2acca7007d519418a75fa59166363dda (6 x RaccoonStealer, 5 x RedLineStealer, 2 x ArkeiStealer)
ssdeep 6144:vvzmxGg/EUIyl7KRnJEeTA5liEGlaOfuhlZXB75SX:vbEf/EUIu7KRKx5liebXNW
Threatray 4'751 similar samples on MalwareBazaar
TLSH T16B448D30B7E0C031F4B712B549B593B9A9287EB19B2451CF63E53AEE66346E49C30787
File icon (PE):PE icon
dhash icon c8e8e8e8aa66a499 (2 x ArkeiStealer, 2 x RaccoonStealer, 1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
91.245.253.52:38439

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
91.245.253.52:38439 https://threatfox.abuse.ch/ioc/229690/

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9c477095786e3f993a820863dfe8a799.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-02 10:43:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f5bf948f-d640-4eb5-b256-a69f702fde92

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/194179/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.27383.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d964f33e-a11a-40de-a6dd-ad0cde068d5a
Result
Threat name:
Raccoon RedLine SmokeLoader Tofsee
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/863172
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus detection for URL or domain
Benign windows process drops PE files
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
DLL side loading technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: Copying Sensitive Files with Credential Data
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file access)
Uses known network protocols on non-standard ports
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 495600 Sample: kwN6azY1TS.exe Startdate: 02/10/2021 Architecture: WINDOWS Score: 100 93 s3-w.us-east-1.amazonaws.com 2->93 95 s3-1-w.amazonaws.com 2->95 97 7 other IPs or domains 2->97 129 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->129 131 Multi AV Scanner detection for domain / URL 2->131 133 Antivirus detection for URL or domain 2->133 135 14 other signatures 2->135 11 kwN6azY1TS.exe 2->11         started        14 rfhhrfj 2->14         started        16 svchost.exe 2->16         started        18 7 other processes 2->18 signatures3 process4 dnsIp5 167 Detected unpacking (changes PE section rights) 11->167 21 kwN6azY1TS.exe 11->21         started        169 Injects a PE file into a foreign processes 14->169 24 rfhhrfj 14->24         started        171 Changes security center settings (notifications, updates, antivirus, firewall) 16->171 26 MpCmdRun.exe 16->26         started        99 192.168.2.1 unknown unknown 18->99 173 DLL side loading technique detected 18->173 signatures6 process7 signatures8 137 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 21->137 139 Maps a DLL or memory area into another process 21->139 141 Checks if the current machine is a virtual machine (disk enumeration) 21->141 143 Creates a thread in another existing process (thread injection) 21->143 28 explorer.exe 14 21->28 injected 33 conhost.exe 26->33         started        process9 dnsIp10 113 193.56.146.41, 49812, 9080 LVLT-10753US unknown 28->113 115 216.128.137.31, 80 AS-CHOOPAUS United States 28->115 117 3 other IPs or domains 28->117 85 C:\Users\user\AppData\Roaming\rfhhrfj, PE32 28->85 dropped 87 C:\Users\user\AppData\Local\Temp\F69C.exe, PE32 28->87 dropped 89 C:\Users\user\AppData\Local\TempFC5.exe, PE32 28->89 dropped 91 5 other malicious files 28->91 dropped 175 System process connects to network (likely due to code injection or exploit) 28->175 177 Benign windows process drops PE files 28->177 179 Deletes itself after installation 28->179 181 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->181 35 63D.exe 28->35         started        40 9835.exe 28->40         started        42 F69C.exe 28->42         started        44 3 other processes 28->44 file11 signatures12 process13 dnsIp14 101 194.180.174.82, 49854, 80 MIVOCLOUDMD unknown 35->101 103 t.me 149.154.167.99, 443, 49847 TELEGRAMRU United Kingdom 35->103 73 C:\Users\user\AppData\...\vcruntime140.dll, PE32 35->73 dropped 75 C:\Users\user\AppData\...\ucrtbase.dll, PE32 35->75 dropped 77 C:\Users\user\AppData\...\softokn3.dll, PE32 35->77 dropped 81 56 other files (none is malicious) 35->81 dropped 145 Detected unpacking (changes PE section rights) 35->145 147 Detected unpacking (overwrites its own PE header) 35->147 149 Tries to steal Mail credentials (via file access) 35->149 151 Tries to harvest and steal browser information (history, passwords, etc) 35->151 46 cmd.exe 35->46         started        153 Contains functionality to inject code into remote processes 40->153 155 Injects a PE file into a foreign processes 40->155 48 9835.exe 40->48         started        105 193.56.146.60, 18243, 49900 LVLT-10753US unknown 42->105 157 Query firmware table information (likely to detect VMs) 42->157 159 Tries to detect sandboxes and other dynamic analysis tools (window names) 42->159 161 Hides threads from debuggers 42->161 51 conhost.exe 42->51         started        107 138.124.186.2, 27999, 49897 NOKIA-ASFI Norway 44->107 79 C:\Users\user\AppData\Local\...\ubzkpkym.exe, PE32 44->79 dropped 163 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 44->163 165 Tries to detect sandboxes / dynamic malware analysis system (registry check) 44->165 53 9B82.exe 15 24 44->53         started        56 cmd.exe 44->56         started        59 cmd.exe 44->59         started        61 4 other processes 44->61 file15 signatures16 process17 dnsIp18 63 conhost.exe 46->63         started        119 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 48->119 121 Maps a DLL or memory area into another process 48->121 123 Checks if the current machine is a virtual machine (disk enumeration) 48->123 125 Creates a thread in another existing process (thread injection) 48->125 109 91.245.253.52, 38439, 49869 V4ESCROW-ASRO Romania 53->109 111 api.ip.sb 53->111 127 Tries to steal Crypto Currency Wallets 53->127 83 C:\Windows\SysWOW64\...\ubzkpkym.exe (copy), PE32 56->83 dropped 65 conhost.exe 56->65         started        67 conhost.exe 59->67         started        69 conhost.exe 61->69         started        71 conhost.exe 61->71         started        file19 signatures20 process21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fab15b7f61f816cf3128cc02c96d98d3385533087bc5afe3cd3799e7e034ce7f/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-10-02 10:41:05 UTC
AV detection:
25 of 44 (56.82%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7kyvw73b7alm6mjizqbms3my2m4fkmyippc27y6ng6m6pybuzz7q._file
Verdict:
malicious
Similar samples:
44e29e5cd002e8d4d4f13432847f38fa79a1667b5fdef9b9f316c3501f3bb480
RedLineStealer
4ba939154ee9df1004629da3aee541a36eb4faabe421190ddbbbf1ccd195e03a
RedLineStealer
85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6
RedLineStealer
d14036b4ab78b2c6121138471582c33a4bf0dbd2076f4c9e640d34a994fce2d3
RedLineStealer
d4bec541272c470bc24653ca13fe85d4011e300b79026b767c6bd3abcb93b637
RedLineStealer
d852901bdc93f05c0dbb9692dfe08ca5465dadce441ef722b617314578fd5c0f
RedLineStealer
d9d7046f7539fd97259759a51b02650790a961ddb0d8f0b9f31c76faf6d63a91
RedLineStealer
e01749cfd587ae7029247ef900df2eb0e89e2fc594ca665d460a73bfa9564647
RedLineStealer
ec078bf46a67bb519f2f15227a024af19356993f9b5b26bd16d9248f42fb373d
RedLineStealer
f085d79b0b46ad9eda7f2191e2e668314553251ab5d0f4936f84cd2c1afa2564
RedLineStealer
+ 4'741 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader family:tofsee family:xmrig botnet:5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 botnet:gold_proliv botnet:new backdoor discovery evasion infostealer miner persistence spyware stealer suricata themida trojan
Link:
https://tria.ge/reports/211002-mq39hsedam/
Behaviour
Checks SCSI registry key(s)
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Checks BIOS information in registry
Deletes itself
Drops startup file
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Themida packer
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
XMRig Miner Payload
Raccoon
RedLine
RedLine Payload
SmokeLoader
Tofsee
Windows security bypass
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
xmrig
Malware Config
C2 Extraction:
http://fiskahlilian16.top/
http://paishancho17.top/
http://ydiannetter18.top/
http://azarehanelle19.top/
http://quericeriant20.top/
91.245.253.52:38439
185.92.74.21:80
45.140.147.106:12318
Unpacked files
SH256 hash:
592b089027938156e18387e4402b965a5f1ffc25e96d7efc3aa9331254587bdd
MD5 hash:
2dbb1eb8c40c88994738a736ad55c79b
SHA1 hash:
88e2fc9242606c7dfcd68d5da8c6d457837157a3
Link:
https://www.unpac.me/results/5ffa8b9d-2de7-4b83-8912-e81b89899f8c/
SH256 hash:
fab15b7f61f816cf3128cc02c96d98d3385533087bc5afe3cd3799e7e034ce7f
MD5 hash:
9c477095786e3f993a820863dfe8a799
SHA1 hash:
056c5c26f208e5772e9f67b77389f989c44e1933
Link:
https://www.unpac.me/results/5ffa8b9d-2de7-4b83-8912-e81b89899f8c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/fab15b7f61f8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fab15b7f61f816cf3128cc02c96d98d3385533087bc5afe3cd3799e7e034ce7f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe fab15b7f61f816cf3128cc02c96d98d3385533087bc5afe3cd3799e7e034ce7f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1649571/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/194179/

Comments