MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 154b094a0357d82ab9e90f1d15d1a9bf5a433f928b510eb05c69a06bb36ea604. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 154b094a0357d82ab9e90f1d15d1a9bf5a433f928b510eb05c69a06bb36ea604
SHA3-384 hash: dda721fd92f98d95f5af06d7b30027d3dfba7c158db36987ff323405d3360172d1443b9e123f0e460e32ab39cd32208e
SHA1 hash: 2611a98b415c45621d8e2851088dbd9ee9de25ff
MD5 hash: 21614302c56ebde877aefeb1c22bc40b
humanhash: robin-mockingbird-spaghetti-maine
File name:PGMB New Order 18-2938PDF.img
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'638'400 bytes
First seen:2020-10-07 05:02:07 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:NZIlvNiGcVKNRVa4Divv6W/6iQmAmHFbAhQb9o7vj+SiyyjK:rIlYG6o1GEirAmlsmbkKd8
TLSH 6B75BD412288459BF123A4B5956FC470A6B5AC8A8514C28D3FC6ED3FFACFB8174E674C
Reporter abuse_ch
Tags:img RedLineStealer


Avatar
abuse_ch
Malspam distributing RedLineStealer:

HELO: acehardware.com
Sending IP: 108.31.118.24
From: Will McCann<sales@acehardware.com>
Subject: Quote Request
Attachment: PGMB New Order 18-2938PDF.img (contains "GMC New Order 18-2938PDF.exe")

RedLineStealer C2:
http://wolf957.duckdns.org:35253/IRemotePanel

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/154b094a0357d82ab9e90f1d15d1a9bf5a433f928b510eb05c69a06bb36ea604/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 00:51:56 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cvfqssqdk7mcvopjb4orlunjx5negp4srniq5mc4ngqgxm3ouyca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/154b094a0357d82ab9e90f1d15d1a9bf5a433f928b510eb05c69a06bb36ea604

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RedLineStealer

img 154b094a0357d82ab9e90f1d15d1a9bf5a433f928b510eb05c69a06bb36ea604

(this sample)

RedLineStealer

Executable exe 253699419919004fb74774050abd7d0137363801f969ad6a5a9dd96c924308b1

  
Dropping
MD5 4b155568c93b744eadea5dd3baa57945
  
Dropping
RedLineStealer
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 253699419919004fb74774050abd7d0137363801f969ad6a5a9dd96c924308b1

Comments