MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b978c678da7d399668880b33e4541494bb4cb301e73903d1f5af3a800a8c36c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 5


Intelligence 5 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b978c678da7d399668880b33e4541494bb4cb301e73903d1f5af3a800a8c36c
SHA3-384 hash: af4062668245326f3a5546d5db087af76e84a9990f5d8f9c27a13744d83742de78a8acc461a985dc41069f14acf9d35a
SHA1 hash: 1a6782362754cf8a561db8470162e40cf48dd1e0
MD5 hash: 5c4e0de7c76302e12a2dec6de731fe04
humanhash: nebraska-pennsylvania-shade-bluebird
File name:Celadon.zip
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'464'617 bytes
First seen:2023-01-19 17:25:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: 3{r8N5YN2i+unwk6
ssdeep 49152:RlxHV06sIWuf01hEkPNd4xrEIfa/zf2M0YGKn+3/+yo:Rl06HWuMFNaEycmYV+s
TLSH T17FB533E2097AC9C5B29CB68CCFEBC0F977464EE7FFDAA25724AD8475098113493AC150
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter iamdeadlyz
Tags:95-217-102-105 exe file-pumped pw 3{r8N5YN2i+unwk6 RedLineStealer zip


Avatar
Iamdeadlyz
From celadon.game (impersonation of the Celadon game by Karpopper - store.steampowered.com/app/2093680/Celadon)
RedLineStealer C&C: 95.217.102.105:1695

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
95.217.102.105:1695 https://threatfox.abuse.ch/ioc/1068957/

Intelligence

File Origin
# of uploads :
1
# of downloads :
186
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:MicrosoftRuntimeComponentsX86.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:922'000'000 bytes
SHA256 hash: 8eaf2e351a8c4e020fe7bc9b967ad4e5d33dd5def7105cb8f254922506935fe4
MD5 hash: c299566e68ef1ec20ddddc3c9597585a
De-pumped file size:3'150'336 bytes (Vs. original size of 922'000'000 bytes)
De-pumped SHA256 hash: 3612149bd6ec449427d2aea29be28c3b93d7e58407fe865db4ac938b2747c2f4
De-pumped MD5 hash: db309a281f2133bfe5cf1c74ee47c275
MIME type:application/x-dosexec
Signature RedLineStealer
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/8b978c678da7d399668880b33e4541494bb4cb301e73903d1f5af3a800a8c36c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b978c678da7d399668880b33e4541494bb4cb301e73903d1f5af3a800a8c36c/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-01-19 12:10:05 UTC
File Type:
Binary (Archive)
AV detection:
3 of 37 (8.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rolyyz4nu7jzszuiqczt4rkbjff3jszqdzzzapi7llz2qafiynwa._file
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:123 discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230119-xys4maea5s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
Malware Config
C2 Extraction:
95.217.102.105:1695
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

27943821044a84f7b3c65fc3004d6f12b3790f545f99bbc57db0e567b750e795

RedLineStealer

zip 8b978c678da7d399668880b33e4541494bb4cb301e73903d1f5af3a800a8c36c

(this sample)

8eaf2e351a8c4e020fe7bc9b967ad4e5d33dd5def7105cb8f254922506935fe4

  
Dropped by
SHA256 27943821044a84f7b3c65fc3004d6f12b3790f545f99bbc57db0e567b750e795
  
Dropping
SHA256 8eaf2e351a8c4e020fe7bc9b967ad4e5d33dd5def7105cb8f254922506935fe4
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2510063/
  
URLhaus
https://urlhaus.abuse.ch/url/2512725/
  
URLhaus
https://urlhaus.abuse.ch/url/2512727/
  
Dropping
SHA256 3612149bd6ec449427d2aea29be28c3b93d7e58407fe865db4ac938b2747c2f4
  
Dropping
MD5 db309a281f2133bfe5cf1c74ee47c275

Comments