MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98e21e2cfae3e46fff64b5808a682ba7db64886c4cf58272e7d3c755c182f99c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98e21e2cfae3e46fff64b5808a682ba7db64886c4cf58272e7d3c755c182f99c
SHA3-384 hash: cbc0de08e535d3132ecb91a26daba75a5556610b7eeecda59e9b0955d88a373e7c09ffbed618285d5bb8047b7d54a7b6
SHA1 hash: 732a407850e61c340fa6da0f237cfad9281fa2cd
MD5 hash: af14307b72da09f6bf6006cfe40a585f
humanhash: ten-saturn-batman-magnesium
File name:ITEM LIST.IMG
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'900'544 bytes
First seen:2022-05-24 06:26:52 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 49152:QupON6ornm6gmEttP+QIjw7EU0e89KXlGlYZl7l3l1llDVlnl1xlLboykfLdMPRZ:lpONfEmQRxA0lGlYZl7l3l1llDVlnl15
TLSH T1E5958D1072988A15D0EE3B76D7E7841A07B6ECD21B72C60D764E779A49723839C1F32E
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:img RedLineStealer


Avatar
cocaman
Malicious email (T1566.001)
From: "Jayakrishnan T.P - LSAW <Jayakrishnan@arabian-pipes.com>" (likely spoofed)
Received: "from [37.0.8.130] (unknown [37.0.8.130]) "
Date: "23 May 2022 18:48:53 -0700"
Subject: "NEW ORDER"
Attachment: "ITEM LIST.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
218
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
msbuild.exe obfuscated packed
Link:
https://www.filescan.io/uploads/628c7ad4eba388bb868153bf/reports/9ab47205-6c14-4824-803e-9e7f396c01b9/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98e21e2cfae3e46fff64b5808a682ba7db64886c4cf58272e7d3c755c182f99c/
Threat name:
ByteCode-MSIL.Trojan.Tedy
Create hunting rule
Status:
Malicious
First seen:
2022-05-23 08:57:34 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
16 of 40 (40.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tdrb4lh24psg773ewwaiu2blu7nwjcdmjt2ye4xh2pdvlqmc7goa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/98e21e2cfae3e46fff64b5808a682ba7db64886c4cf58272e7d3c755c182f99c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RedLineStealer

img 98e21e2cfae3e46fff64b5808a682ba7db64886c4cf58272e7d3c755c182f99c

(this sample)

RedLineStealer

Executable exe c71775afd82043e34a09cf99d4ca571b52e9be5c4d808af8ef2c6f1333e9c335

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c71775afd82043e34a09cf99d4ca571b52e9be5c4d808af8ef2c6f1333e9c335
  
Dropping
RedLineStealer

Comments