🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03b3e5eac8bd9aeef359cdae2400a6df4dc8ba6724be5d1cf2d19d2b0f5ee58a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03b3e5eac8bd9aeef359cdae2400a6df4dc8ba6724be5d1cf2d19d2b0f5ee58a
SHA3-384 hash: e7aad9f6ee7b2f81796caa19fd784e44a3139c1be0e7252b293eb8ae4462ce3fc78a148243d1aa1e07f9b07b5b6e9455
SHA1 hash: cf97b363cc201218691c7df8984444c1a844b277
MD5 hash: 6bc7138c2caa2597f9cc305a2ce791a4
humanhash: sad-mountain-march-papa
File name:Setup.rar
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:862'158 bytes
First seen:2022-11-10 14:54:56 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
Note:This file is a password protected archive. The password is: 9090
ssdeep 12288:cfjskPGqEhHnQUvkA3/CqKCtyjOZbgssBY9I+C5jcuPAVdvP5TeUacvH1GkZ8tDH:iPREpQ8KCvZb/90594VtReAZ8tDlP1
TLSH T18C0533032E66EB079EB4C2A30FE83BB5545782A2D9DFF53D1C4D0BB6EF810185963654
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter crep1x
Tags:9090 file-pumped pw-9090 rar Redline RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
FR FR
File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

File name:Microsoft.WindowsPack.dll
File size:587'776 bytes
SHA256 hash: 6ea25be49a4e96c43c20bc29eb1ced078f4e0bcec4673ce722271c77bc2fa121
MD5 hash: f6a0bdf17dbfdc16cec93537731571d4
MIME type:application/x-dosexec
Signature RedLineStealer
File name:x32.config
File size:189 bytes
SHA256 hash: 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
MD5 hash: 9dbad5517b46f41dbb0d8780b20ab87e
MIME type:text/xml
Signature RedLineStealer
File name:x64.dll
File size:38'400 bytes
SHA256 hash: c21bc4847ac3c75db64b5f7afeb0fcb0e22ba436b7db80692523b4810b046d22
MD5 hash: 7f616473bc928975d2d8e9897e41d1e3
MIME type:application/x-dosexec
Signature RedLineStealer
File name:Microsoft.Pack.dll
File size:114'176 bytes
SHA256 hash: 21e140dcafa3e251373a712423bb111570737e95e4dcfb6f56868d7086af7686
MD5 hash: 5d7da47c86475dd23094ce4bbb6c9001
MIME type:application/x-dosexec
Signature RedLineStealer
File name:Setup.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:803'945'124 bytes
SHA256 hash: 1ee7c691c5a1a25a3e6d15bc43abf8cbc2039db5991a6ac7acfed2a0c95468ea
MD5 hash: c79d7ea2a70e1a94a3693f8b9ab7f0fc
De-pumped file size:1'606'144 bytes (Vs. original size of 803'945'124 bytes)
De-pumped SHA256 hash: 4a68e6a4b3691e027dfb50e0773ed86f2130e457cd86457afd87c4d9979d7bba
De-pumped MD5 hash: e61c93d7e181d04c931635ed169d15da
MIME type:application/x-dosexec
Signature RedLineStealer
Vendor Threat Intelligence
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/03b3e5eac8bd9aeef359cdae2400a6df4dc8ba6724be5d1cf2d19d2b0f5ee58a/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aoz6l2wixwno542zzwxciafg35g4rothes7f2hhs2goswd264wfa._file
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer spyware
Link:
https://tria.ge/reports/221110-shw35aagc6/
Malware Config
C2 Extraction:
168.119.228.126:11552
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/03b3e5eac8bd9aeef359cdae2400a6df4dc8ba6724be5d1cf2d19d2b0f5ee58a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

rar 03b3e5eac8bd9aeef359cdae2400a6df4dc8ba6724be5d1cf2d19d2b0f5ee58a

(this sample)

  
Dropping
Redline
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2407017/

Comments