MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cc3f1d076d8c44fb55dfa11c94936fba23153c72402d0ff83733258e7c425c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 2

Intelligence 2 IOCs 1 YARA 4 File information Comments

SHA256 hash:	6cc3f1d076d8c44fb55dfa11c94936fba23153c72402d0ff83733258e7c425c2
SHA3-384 hash:	61ced804f8d5818135c6def0fec1c4c69be0d7fc9302e8e1e9fff00855dd37a6e2f5b64f1429b876a1742accc9a73f7d
SHA1 hash:	180974ded6a1eb48c2f658740ba55789ecf7c99d
MD5 hash:	2a10eccfead0c89635df6177b1cfa325
humanhash:	papa-foxtrot-autumn-hot
File name:	pureland.7z
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	415'746 bytes
First seen:	2023-03-07 21:03:56 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
Note:	This file is a password protected archive. The password is: pureland
ssdeep	12288:ldasjTmuF0izskhNby8ofzEtj71hi+Pf3W1zc:lgeyQ0EhU86EtHO+PvR
TLSH	T18094235BD7A6E08A636F9F430AF349B003DF61F7655F1694B1871CED2B81C2839602E8
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Reporter	iamdeadlyz
Tags:	162-55-188-117 7z exe file-pumped PureLand pw pureland RedLineStealer

Iamdeadlyz

From thepureland.io (impersonation of Rune Teller - https://store.steampowered.com/app/1944360/Rune_Teller/)
Related incident: https://www.coindesk.com/business/2023/03/02/blockchain-game-the-sandbox-warns-of-phishing-email-after-security-breach/
RedLineStealer C&C: 162.55.188.117:48958

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
162.55.188.117:48958	https://threatfox.abuse.ch/ioc/1078699/

Intelligence

File Origin

# of uploads :

# of downloads :

332

Origin country :

n/a

File Archive Information

This file is a password protected archive. The password is: pureland

This file archive contains 1 file(s), sorted by their relevance:

File name:	pureland.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	688'249'296 bytes
SHA256 hash:	48680a6a919a53dfb5eb47a798a9d8135601179630e6308023f30e1f9b13301d
MD5 hash:	02de331d9164e72c10e3b217b2801d89
De-pumped file size:	374'784 bytes (Vs. original size of 688'249'296 bytes)
De-pumped SHA256 hash:	08ed972fb6d88ef000b2825e2818810b282507ec90dcc406fa5999f507a71fc8
De-pumped MD5 hash:	9e4d5fb4a69f85b267e595e3ac2565e3
MIME type:	application/x-dosexec
Signature	RedLineStealer

Vendor Threat Intelligence

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6cc3f1d076d8c44fb55dfa11c94936fba23153c72402d0ff83733258e7c425c2

Result

Verdict:

UNKNOWN

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6cc3f1d076d8c44fb55dfa11c94936fba23153c72402d0ff83733258e7c425c2/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ntb7dudw3dce7nk57ii4ssjw7ordcu6heqbnb74domzfrz6eexba._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.