🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 950250c31d8a4f6aefacbd627bcdc0b40432d860e3e4e009a5e73b27e4aa8401. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 950250c31d8a4f6aefacbd627bcdc0b40432d860e3e4e009a5e73b27e4aa8401
SHA3-384 hash: e8103cbd9ac2544a0737dfebb01006617dcf70f24e0ab318682a3793e5996a5e1bc7d83c3cdbe317cebb63e92049f709
SHA1 hash: dd9d5947cf411a31d0dd22a1cf0260a401d8c40d
MD5 hash: 72402688f785d2a901fef14b9260907a
humanhash: queen-hot-hydrogen-muppet
File name:CollapseHack (1).zip
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:5'550'899 bytes
First seen:2022-02-08 07:35:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:YuirPh9itXqLPTksBRkXvi1TjARrePQf6emXM4nIZrmYIllgIUSj7M:4KYJYq1TERaL5c4smYITlM
TLSH T172463341C566A926EF0EECBD265012152BB3FBCFD3D742CAD1562B7F344296F2E80984
Reporter adm1n_usa32
Tags:exe Redline RedLineStealer zip


Avatar
adm1n_usa32
zipped due to large filesize (300+ mb)

Intelligence

File Origin
# of uploads :
1
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.32261.20863.2628.UNOFFICIAL
Create hunting rule

Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/950250c31d8a4f6aefacbd627bcdc0b40432d860e3e4e009a5e73b27e4aa8401/
Threat name:
Win32.Infostealer.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-02-08 07:36:44 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
4 of 43 (9.30%)
Threat level:
  5/5
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/220208-jfabxaefgk/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

zip 950250c31d8a4f6aefacbd627bcdc0b40432d860e3e4e009a5e73b27e4aa8401

(this sample)

  
Delivery method
Distributed via web download

Comments