MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8ed0a93981f84fd0d865046684ec5945f35b83540874fe38e29f9d9c0d3ffee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 2


Intelligence 2 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8ed0a93981f84fd0d865046684ec5945f35b83540874fe38e29f9d9c0d3ffee
SHA3-384 hash: 02f936956588597feb67e19d76f6797255c70646c9bd28340ae0a54d8fe03c260fa06d5a7ab54269ae11d8639892a053
SHA1 hash: 17313514aa41641b4050be7e4b79679d75792283
MD5 hash: a3fb0b17bcd26bc593a6c5009072d1be
humanhash: fanta-vegan-mirror-maryland
File name:MisteriumLauncher.zip
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'946'976 bytes
First seen:2023-02-07 14:43:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: playmisterium
ssdeep 49152:5le4WcMuU7f7GAVRcBDFOo4L98Dl8/Z+XLzcizDfdQHhXwIXZMjkwHICjFl71++M:5leqMuC7GicBD94R8DWoXLzTD1eWkuIh
TLSH T1E7D533443A0A28A9D4C510FA7AEE15B03301FB95B56D7E134E7058F9D86F93F2B52F28
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter iamdeadlyz
Tags:162-55-188-117 exe file-pumped Misterium pw playmisterium RedLineStealer zip


Avatar
Iamdeadlyz
From playmisterium.com (based on a previous scam called Mysterian - mysterian.io)
RedLineStealer C&C: 162.55.188.117:48958

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
162.55.188.117:48958 https://threatfox.abuse.ch/ioc/1078699/

Intelligence

File Origin
# of uploads :
1
# of downloads :
205
Origin country :
n/a
File Archive Information

This file archive contains 13 file(s), sorted by their relevance:

File name:UnityEngine.dll
File size:307'200 bytes
SHA256 hash: 08f01b59ab2d2d6fa2cd444476cb4900656847f9f948d698bcfabcd20c892df5
MD5 hash: a82bc6f67bdeb3a9e317228801d6161b
MIME type:application/x-dosexec
Signature RedLineStealer
File name:mainData
File size:53'026 bytes
SHA256 hash: 7a83959c09099fb5a2d3dcdc348771c64d35135599852e55263b8d3f20896385
MD5 hash: 76c9d2e8ed289d5e6c3048bb848c2eac
MIME type:application/octet-stream
Signature RedLineStealer
File name:config
File size:33 bytes
SHA256 hash: b1a6275de8669da24873ea46402bbd53eb3701f4f6d9cb6815b744d9870643ff
MD5 hash: 453fb889d7b10b58294fd6a17420265a
MIME type:text/plain
Signature RedLineStealer
File name:script.aps
File size:40'112 bytes
SHA256 hash: f156354beba0da4e469b7a4b50f19705247ae5a12f7ca3545d4b7d27e7ebf5a8
MD5 hash: 13b4ccc8870d67e0557bd9543bf42596
MIME type:application/octet-stream
Signature RedLineStealer
File name:Assembly - UnityScript - first pass.dll
File size:16'896 bytes
SHA256 hash: f1f47df02b96dd90532d3c5d40f6c3b683d79f9e4494287e1c75791a113acf0c
MD5 hash: 9d2e96b4d76559b740a431c558efa6f1
MIME type:application/x-dosexec
Signature RedLineStealer
File name:mscorlib.dll
File size:2'508'288 bytes
SHA256 hash: 4105003ff3935846677a6bf013946e483d9804585c0f5556e432befc6bf25aa3
MD5 hash: 7023c05782a32bd52276514d363c9eb3
MIME type:application/x-dosexec
Signature RedLineStealer
File name:mono-1-vc.dll
File size:1'592'832 bytes
SHA256 hash: eb7e470c7753ae301b75a4bf238f9951638893fc5965fce46de95d4db82c24a7
MD5 hash: e04e871da9be6c8135e16fdb59b4d6da
MIME type:application/x-dosexec
Signature RedLineStealer
File name:UnityDomainLoad.exe
File size:3'584 bytes
SHA256 hash: 27d191deac86170eb7bd75d4bbe2b8160ec13125309819a047f8758507bdf3ee
MD5 hash: 119e1bd6e6c625c53e35e6153781f9f1
MIME type:application/x-dosexec
Signature RedLineStealer
File name:unity default resources
File size:2'065'876 bytes
SHA256 hash: 3472efdde88e87d2338776fb9a74e986934145da80fd0a12c9c34c7e3166b97e
MD5 hash: 17c66e98a74e1d271860dbf715bed421
MIME type:application/octet-stream
Signature RedLineStealer
File name:Boo.Lang.dll
File size:102'400 bytes
SHA256 hash: 439bd9c9cebba28f201bc8c6b9c7673ee8ab66b4bbc5b104921c7870953f2caa
MD5 hash: f7507cfd6adb32eacbe1e6a0b4dd6658
MIME type:application/x-dosexec
Signature RedLineStealer
File name:machine.config
File size:20'853 bytes
SHA256 hash: 6e0ee174f63ab9f0d72c4e47ffd1096ce0d328ab3bd81a13c6abc129510f1259
MD5 hash: b35c9aa9e478a03777f7b54e9e14665e
MIME type:text/xml
Signature RedLineStealer
File name:Assembly - CSharp - first pass.dll
File size:4'608 bytes
SHA256 hash: 09bfefc695b90dd5deabfaaa234fa6d2da794efe0fbcca68b1a06c1bdeeff3fd
MD5 hash: 518ae29bd45cfbf4db9de22e40c21da5
MIME type:application/x-dosexec
Signature RedLineStealer
File name:Misterium.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:688'288'208 bytes
SHA256 hash: 04b8181b4a4e97541f533de429331a64f498f71d72509acdde656edade5dcd73
MD5 hash: 2a11d4c2ab76a8c5c99b9845740b96d2
De-pumped file size:413'696 bytes (Vs. original size of 688'288'208 bytes)
De-pumped SHA256 hash: fe11868abbb864dd3821faae6b1879e6899477ebd183caaca3d06bc3c4215f93
De-pumped MD5 hash: dc9ca38a2c59288fe82cb683b60e194a
MIME type:application/x-dosexec
Signature RedLineStealer
Vendor Threat Intelligence
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c8ed0a93981f84fd0d865046684ec5945f35b83540874fe38e29f9d9c0d3ffee
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/c8ed0a93981f84fd0d865046684ec5945f35b83540874fe38e29f9d9c0d3ffee
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c8ed0a93981f84fd0d865046684ec5945f35b83540874fe38e29f9d9c0d3ffee/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zdwqve4yd6cp2dmgkbdgqtwfsrptlobvicdu7y4ofh45tqgt77xa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware
Link:
https://tria.ge/reports/230207-tj3sqsce57/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

zip c8ed0a93981f84fd0d865046684ec5945f35b83540874fe38e29f9d9c0d3ffee

(this sample)

04b8181b4a4e97541f533de429331a64f498f71d72509acdde656edade5dcd73

  
Dropping
SHA256 04b8181b4a4e97541f533de429331a64f498f71d72509acdde656edade5dcd73
  
Dropping
SHA256 fe11868abbb864dd3821faae6b1879e6899477ebd183caaca3d06bc3c4215f93
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2533221/
  
Dropping
MD5 dc9ca38a2c59288fe82cb683b60e194a

Comments