MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f449be9f6532f8b10abcafd276172fcce3cd2b47813ebe6c02cfdc8057bd2bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 2

Intelligence 2 IOCs YARA 1 File information Comments

SHA256 hash:	7f449be9f6532f8b10abcafd276172fcce3cd2b47813ebe6c02cfdc8057bd2bf
SHA3-384 hash:	5eb0a3377d4571a4f894839554116ca54ef95a7475f05344dec9f1aadb7531c146b4d30ad52feb6cc9855f89da171255
SHA1 hash:	c670433ffd3712b52b1a9491c5b5190af09c9322
MD5 hash:	30e5988595f7a417b6b6bf2477c5fce2
humanhash:	fix-fillet-west-skylark
File name:	Fortnite_Aimbot+Esp.zip
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	6'637'908 bytes
First seen:	2022-09-04 20:38:03 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:ADMmHgs+yU2w/OXYfQfAhmj6KDOumETcFnmEA93wlS:ADTHgx2BIfQfA8j6KyzEaAdwlS
TLSH	T1D66633260E254440DE7A6E53F6BF84C589DF7B2EA0869AB179B038F5CB07CC131967C9
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	iam_py_test
Tags:	passwordprotected zip

iam_py_test

Password-protected ZIP file. The password is fortnite220

Intelligence

File Origin

# of uploads :

# of downloads :

748

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/7f449be9f6532f8b10abcafd276172fcce3cd2b47813ebe6c02cfdc8057bd2bf

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7f449be9f6532f8b10abcafd276172fcce3cd2b47813ebe6c02cfdc8057bd2bf/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p5cjx2pwkmxyweflzl6soyls7thdzuvupaj6xzwaft64qbl32k7q._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.