MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 718fa436dfbc7773b31d7ac74b779deae93ac26439bf2516ab14d9a8118934cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 718fa436dfbc7773b31d7ac74b779deae93ac26439bf2516ab14d9a8118934cc
SHA3-384 hash: f507df88a6ef229960886ca375d34c2311cb83677a0556bdf46be97d93c4fabdd899386ca8a22f7eff7e1667ce0db46a
SHA1 hash: 93de483156fcfa8f657b50423c23895a5523903e
MD5 hash: ad8be922c3aed0d6a5ce5f85f75a77eb
humanhash: asparagus-hamper-saturn-pennsylvania
File name:PGMB7666799210001PDF.IMG
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'507'328 bytes
First seen:2020-10-19 07:21:09 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:RQsOzqLTcPLxImo854GIqwgUGQ+zOTd8y:azqLTcPLS28mkK
TLSH C1657D513384AF58E03E177358AE941093F5AD1BD331C50E3ED63E0E5AB2B92A26774E
Reporter abuse_ch
Tags:img RedLineStealer


Avatar
abuse_ch
Malspam distributing RedLineStealer:

HELO: greencconstruction.com
Sending IP: 96.75.192.81
From: Lydia Rodriguez<sales@greencconstruction.com>
Subject: Quote Request
Attachment: PGMB7666799210001PDF.IMG (contains "PGMB7666799210001PDF.exe")

RedLineStealer C2:
http://riraite.xyz/IRemotePanel

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.9b05b5b2117bba9e.24345.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/718fa436dfbc7773b31d7ac74b779deae93ac26439bf2516ab14d9a8118934cc/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 04:15:17 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ogh2inw7xr3xhmy5plduw5455lutvqtehg7skfvlctm2qemjgtga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Adware
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/718fa436dfbc7773b31d7ac74b779deae93ac26439bf2516ab14d9a8118934cc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RedLineStealer

img 718fa436dfbc7773b31d7ac74b779deae93ac26439bf2516ab14d9a8118934cc

(this sample)

RedLineStealer

Executable exe c68e4b825434bac34abd9d5428ea2c30fc60c8b47db17de743782825687547d5

  
Dropping
MD5 9b05b5b2117bba9e352a765546978cd9
  
Dropping
RedLineStealer
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c68e4b825434bac34abd9d5428ea2c30fc60c8b47db17de743782825687547d5

Comments