MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc06b0515b1d0acff129e4016f0c0b8f6827c17c04228bdf100a73825df0c078. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc06b0515b1d0acff129e4016f0c0b8f6827c17c04228bdf100a73825df0c078
SHA3-384 hash: afeb60f1d5647636b453b41791d139f723cf6824b93820c034872ad8be0eb496197a9d6ee2a9affc8858896009b99f2e
SHA1 hash: e969b73f5de63ca9e1fe159fd6270ab9aff975ed
MD5 hash: 6fd2066f3ca38762646cbcb0e8950e52
humanhash: neptune-ten-magnesium-zebra
File name:6fd2066f3ca38762646cbcb0e8950e52.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:149'504 bytes
First seen:2022-09-20 06:55:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8b22e6675f7db1df145f6b7950521826 (1 x RedLineStealer, 1 x Stop, 1 x ArkeiStealer)
ssdeep 3072:U/xKTLFS5+erKHyQbZlM/MN4py+mQx1OZB6Aoovhix:icLFOrKZlM/MNJ6c1v
Threatray 1'409 similar samples on MalwareBazaar
TLSH T1A3E3D0103D84C472C105687A5825D1E19F7FFC81AA119A833BA83F6F5F352D1AA7B72B
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon badacabecee6baa2 (28 x RedLineStealer, 19 x Stop, 13 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
http://88.198.175.205/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://88.198.175.205/ https://threatfox.abuse.ch/ioc/850483/

Intelligence

File Origin
# of uploads :
1
# of downloads :
244
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6fd2066f3ca38762646cbcb0e8950e52.exe
Verdict:
No threats detected
Analysis date:
2022-09-20 06:57:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3ad11eb3-30bf-4870-9c39-97443a413c9d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/311546/
Detection(s):
Win.Packed.Crypterx-9954995-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Searching for synchronization primitives
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Sending an HTTP POST request
Sending an HTTP GET request
Connecting to a non-recommended domain
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching a process
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm greyware packed
Link:
https://www.filescan.io/uploads/6329647eb333b2ec6b38e05f/reports/2440a338-4f56-44b5-8271-83d1695310e7/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/efbc25c1-fe2b-4230-8584-57244b79a5bc
Result
Threat name:
RedLine, SmokeLoader, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1073442
Signature
Allocates memory in foreign processes
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 705984 Sample: 5tztEv4fCH.exe Startdate: 20/09/2022 Architecture: WINDOWS Score: 100 59 Snort IDS alert for network traffic 2->59 61 Multi AV Scanner detection for domain / URL 2->61 63 Malicious sample detected (through community Yara rule) 2->63 65 7 other signatures 2->65 8 5tztEv4fCH.exe 2->8         started        11 jtejvfb 2->11         started        process3 signatures4 79 Detected unpacking (changes PE section rights) 8->79 81 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 8->81 83 Maps a DLL or memory area into another process 8->83 13 explorer.exe 9 8->13 injected 85 Machine Learning detection for dropped file 11->85 87 Checks if the current machine is a virtual machine (disk enumeration) 11->87 89 Creates a thread in another existing process (thread injection) 11->89 process5 dnsIp6 53 cdn-119.anonfiles.com 195.96.151.71, 443, 49757 UTA-ASAT unknown 13->53 55 anonfiles.com 45.154.253.150, 443, 49742, 49758 SVEASE Sweden 13->55 57 11 other IPs or domains 13->57 41 C:\Users\user\AppData\Roaming\jtejvfb, PE32 13->41 dropped 43 C:\Users\user\AppData\Local\Temp\882.exe, PE32 13->43 dropped 45 C:\Users\user\AppData\Local\Temp\7889.exe, PE32 13->45 dropped 47 2 other malicious files 13->47 dropped 97 System process connects to network (likely due to code injection or exploit) 13->97 99 Benign windows process drops PE files 13->99 101 Injects code into the Windows Explorer (explorer.exe) 13->101 103 3 other signatures 13->103 18 882.exe 1 13->18         started        21 7889.exe 1 13->21         started        23 434A.exe 1 13->23         started        25 9 other processes 13->25 file7 signatures8 process9 signatures10 67 Machine Learning detection for dropped file 18->67 69 Writes to foreign memory regions 18->69 71 Allocates memory in foreign processes 18->71 27 AppLaunch.exe 16 18->27         started        31 conhost.exe 18->31         started        73 Multi AV Scanner detection for dropped file 21->73 75 Contains functionality to inject code into remote processes 21->75 77 Injects a PE file into a foreign processes 21->77 33 AppLaunch.exe 2 21->33         started        35 conhost.exe 21->35         started        37 conhost.exe 23->37         started        39 AppLaunch.exe 23->39         started        process11 dnsIp12 49 t.me 149.154.167.99, 443, 49799 TELEGRAMRU United Kingdom 27->49 51 88.198.175.205, 49800, 80 HETZNER-ASDE Germany 27->51 91 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 27->91 93 Tries to harvest and steal browser information (history, passwords, etc) 27->93 95 Tries to steal Crypto Currency Wallets 27->95 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc06b0515b1d0acff129e4016f0c0b8f6827c17c04228bdf100a73825df0c078/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-09-20 06:56:07 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
23 of 26 (88.46%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7qdlauk3dufm74jj4qaw6dalr5ucpql4aqrixxyqbjzyexpqyb4a._file
Verdict:
malicious
Similar samples:
12d0f4e279c8b87d94fba44d8e4a85c553cd96b90256716bd98096ca4c2ba359
RedLineStealer
3b5adc36b8fd04b224008a8b2fc3770532115de8973d21a0f8b3226df887c1d4
RedLineStealer
7fd6ca38752917a128110b73a95e598f823b59ad272f69fed37a6cc51919fe22
RedLineStealer
84edea62538f3dffb999ace09bfd7a276ade6b32ba4c4ec35fdd28f4ae939ba1
RedLineStealer
a70beb61ac3aa68ed844f8bf3a5c9ada717363fc372948c2ef88abb647665f39
RedLineStealer
b5938ac3434dba249dd144d180b2d9d1fae0918b81630497c458781acd3afed8
RedLineStealer
b59605ff1e997171a997bb380245239829c8b87e26846e6612241afa85b542ee
RedLineStealer
b5aedf88db5ca22f172a80f49264d768d19c0481e12ffd1b653ed01a2d6be104
RedLineStealer
c72bf997c9a2c92574eab7a06490125dba02b9b8cb75142812213161da56496c
RedLineStealer
e3f6666bcc343098a21a2c52ee8a63d03c042b9dfd4cb1dfbf984c6d0e985da0
RedLineStealer
+ 1'399 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/220920-hqcpcacbf8/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Downloads MZ/PE file
Executes dropped EXE
Detects Smokeloader packer
SmokeLoader
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7b75a2c0-d5d9-450e-8481-9a4437fb7aa1
Unpacked files
SH256 hash:
9792b2f0eb2b1aad1a7416e4ad4099d0551758bb9dd65ef2c8aff26192d20c9c
MD5 hash:
9eec547db5a291f2695c6147dbc7177d
SHA1 hash:
67a643f41e17f11a2d27d84037392012b57913f9
Detections:
win_smokeloader_a2
Create hunting rule
SmokeLoaderStage2
Create hunting rule
Link:
https://www.unpac.me/results/6f9fddf8-1c82-48fc-b087-f99b5ec0dce4/
Parent samples :
de2912f0955e066d268cb9ea411c31d49878d94be3ce444e1e33ef00b0d14407
fc06b0515b1d0acff129e4016f0c0b8f6827c17c04228bdf100a73825df0c078
18beed2a315224d9fd79f3298dd91518b99c16f49d38796485d75cac2a135b1b
c0265c728821cab03a2487165bb49b734a653aefbdd2a9a67768efff4cca172e
cfc5fcbf9856cf28838a27f1779e0ab860a7886329cd368f726e980dc72e266e
b4770db42a8117271e82b3b3afc128dea4f4090322b326477498f60c9fe21059
48f43556d196cdd49c48e06b4a9d34aef99847534b056afca5a00dc07fb1acc3
c5239df535857220bf4a1d11f1281ceb168ffb0cd7b0e0cd37fb556e0cb04193
1f63d7b1fc905bcef2d468fd52e37515d568fbd0d9656c62cd9eda173f21f4e4
a519a31a304485bc64fa4796655641ab62e5c07f35b34ede98de5c6bb0082ca7
427c95ff1528c467e90476ee77b6f7b04a587113629e254e82e5bbdfcbf92bb7
11212a25a03d681bfb1a7b537b8e066c09d506a30728bd377d47480d8274847a
ec2327749fcfe81de5944c76521528d4df2c841e2ab56f728a2a2998ac390f53
7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307053254a266e3602cc8f
08879335463d74ba06f8cf8548a59e3a246a37d2bacec19937054f0ee3bf819a
fa1597898a74d717afcad5809dad53880d34f25f106736bb3fd4835e93204ae1
da59178b5bdf3c372a7ee466713990a0021e2ac5880b8d19b2ddb035ca0e2c9c
ca81d370ff7e2f2b429d2c1ff109a351f66f5bb9799d34c424aaaac684ed59a4
04c998230407616fc3f626c05a523583eb659818834ce07692a4de9fe678a732
f661ec60e29f3bd12a3d4db867d37cd78ab2104f7c27b63624433a66d514113b
789edea2f682ba7f2caf76a0a3ca8559c5204627fd4a829cc863f06017686ccf
a4b18ce54301fdad6c022f031fb60c656b730ac90399ee7b2a8ba2f675b0297e
0dcb665bf83e5de02dac89f4c72741b5330fa15bd8bb45508a756d9d6f5f3a72
4eb0e488227caebf4bcedbff8768d84cd46f4588cfb067410ab298c24afdc3b5
ac200dfd46cb14b4c59f30198d261a64a5a90972ec0439d0da7ec6c2fc209a69
f090029ecd2264b984721ed50bf04094fcf183311b87930d1816534f4dd6da4e
2a97eefb81b0234328c6d859fdc1c1177d4850691d31162c8c5708e94a452138
7b49988a41f87260871578ac40ee21ce66a9b8fc614775875675866ff13188e6
481201152d564d542d01c316ec85431d62f6175720fe28f9ca89e6366d73c3c6
93d65be11493447f9d40d806d4e35b1bf5dfc4b0834bf20cd0e447e893894910
40a510dd9933e02e51e62b91d854aaa2612c41b4bbb999cfa5c872f3370d13b6
09d9bb25f1d1bd6f7c3e3aa64df49eaa398e9f26b198ef9b92b6c18c804f0bc1
068ae3605b91f7ef4fc55da190972bbc6286ba415d277ef49e98cbad92e7843c
ff14a00150284811bbe39c1eaf0e0fe7f11aef6c3822feea012ce62fb9d9dfb8
dc131f02d7979e9e02a35a7587bc9ac98155140f7b005892d15916893abe5cbf
ec826faf723057c91169f41ae7c1720d1f2391ac6d5f7c55075274221523f7b5
24b3d36dd1e117a17fcc7bbda20bf4e3afe69b674a9ac7cae483a3a31e9de5fa
72ba4cfd959620d844ee73b52d5094ed282344cdbbcf2762722ba79dcb86225d
b4b3e1a2ac1fc40f877c13268abdcc295f043c8bf8ce2886cf9cdab16fb81edd
c47a6d3e018fdbc0f63c224735e6ed5746bc6a70c26f7c60e9ccdcd030ac38e6
707a04a12631b78cc0b83d4218a3c2caab5a031a0352fb85c2b5c761c937b0be
6336b9fbb76277167facddac816655d079a8604f7273b2bb8dad169d1723c793
0f8b56af0b1be1247a5bf989a92eca657855d96e4b3b9eac1a109cbe8bfbd40a
0fdeafeda5401dd9a63c5d2b3297af4a0c55acb3eacd415f26b48698209c1f4a
08415e962db965deaa4e02ecf2e198942100c56b5835e9298242da837b585b69
bf53766eb860140c6914ffb3bb1fa152e709e19b04b932e16dd26c16a8008c17
2e6e8729d76dc13a750db437a1677e60d579f785714e7c5bbff65085be0f08bf
fe7a13d4f8685767fee1cba9fe64ae0ffe1ff8ef75e7bf0bacedc0bfadea65b8
beca004dfd77f218a00baeb20a2e0d26ffcb0e8c88abc1fcdec9b8b78e289255
7a0268be5fbffbe146338591959ffe772ca26a3b78bda1479db38791952aa4e2
beff5a79e3ddd5ea4bd7949b4935d3f21fb10968d0317051ba298b024cde943f
d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9
aae1fefb67ab509c078638b5ba82bd724a9fbe634c620c94c790e0981bbf270e
16842d889bdac3685118f3ce1e2ac6e352ade59800f46fbdd4cc60f586502feb
8fd916f77448322da50802bc0fd2ae0492932f42c742f9b996a56ec66f13d564
beb38b475d203dd46d3d1fa63ca34a83df6c45775b348279a5dc19ef1a861336
91c71931cf8c74ba9c417034c0317d8e8e71f9917aaacb11e86b532091f0caef
a27b8247b250cc81af64776356a4399d6d36ec4e3b15e484e2ebae60fbd77040
52179b6fdf543bbe889d1d67a83bba9fc25ec33da4ef630472025932d4ee3192
6014786b41622c5201cdb283d606c70831da00f1d890087b2be68fb4f5515e71
acaaedee4683ce2d097a80bc6d6815408d48b809f0df56ca653319737748dc23
76e1d32e444437378a8561d13a082d31e0fc35effeb46cc618c82a4ed98db622
2a63ec67519f9fd59f54c4ed1a6a9b82ca3e7f6e29cce42b42f41d3a68f0e64a
963325e138a79d2c9f72f61bda8601704629c526a7f707eb9cd689efab376d11
8862f70691d3e4fd9993c7bec511b4829403f15fba9b7999708edc372da0103c
0f8f4678218df508896a6e58d5d206adb8991f8cef033dfae733d5a2a12a2fe6
4911e25310acfe3efe4ed72720cdfe857a33dc6c0dbaf94120858aedae58baf4
9d23a234dbe5c77bdb7ef8c15e72dc31de7cce7a296ba4c6021fa38c860b6aa6
66db6bba6cd5a20a84720a71783077ed39830a52b6231ee42508a17805899d80
bacbbc495f8feb32cf7634b1e66c448cacb7f5f91d18e5d2682a6e903adb4744
6a7d48f08212a61d9fc4202234cd290a42fdd8eebbb53d90c57dc971a159caf3
becc55f0da56190c49c0b6043e9e7edaf68621331434f23f037f99a41d476ce0
3b27cb347865bcc539b7faad94c6ed0d383e2fec84f2ec6c5d32bfb83ba03def
950d626cdf9aa112d51ab6464231f153a8b72c7da5d2de8ffabbe86f1f356f84
4296f6d95543d642919a532ad639b2f0e1e0d004f80c1abafdfea4f02c10aee8
b99e21dce83c8184c7396d9b0fb284ce0ce662a1cc9d1ad59448000eac1bd806
b28d6b994dcacc0d94a798011c1f7f6ba7bb293e0260159b60104620f320e01c
2d4a9826902438e97fd11eac1fe05819dbc649be0e006b849336079fff0ccf18
a28b2614336ba255b5c7d33b2a7eb8b29ffedf766871c2a5be8e67270b32b0af
e98425cc4d2e9f27570c6df58a67abb8e9e05f0c84359a556958a4a67c1b3e53
d5e5f7d079b216078282d955c2d625bda28ca2a4de774a46ab571c388d897dac
d898c6a965e975401a73dc7068488e0248bc10a0794cb2600fa12bc6d63007d8
4d2921f38a5bbc12057aecb0e0a370ecf21035428fa2a8508f03023aabde3754
bbe0f79b031a4f2c83578fbe30e1f51881b2bbb1ec53051d785f1f4bbbb238c7
ee8601daf173de7abca7dbe5335a6d9511de07fa40cdec51d0a82246575a35cd
670b1670bc457d64c885cbca3aebcf462aae5086707585f610c4fedc8f4ee073
SH256 hash:
fc06b0515b1d0acff129e4016f0c0b8f6827c17c04228bdf100a73825df0c078
MD5 hash:
6fd2066f3ca38762646cbcb0e8950e52
SHA1 hash:
e969b73f5de63ca9e1fe159fd6270ab9aff975ed
Link:
https://www.unpac.me/results/6f9fddf8-1c82-48fc-b087-f99b5ec0dce4/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fc06b0515b1d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fc06b0515b1d0acff129e4016f0c0b8f6827c17c04228bdf100a73825df0c078

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe fc06b0515b1d0acff129e4016f0c0b8f6827c17c04228bdf100a73825df0c078

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2303568/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/311546/

Comments