MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cac62fa71e5789c01000d09ad82796e8dc4ba029896dfa21d7beddf683c05dcf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cac62fa71e5789c01000d09ad82796e8dc4ba029896dfa21d7beddf683c05dcf
SHA3-384 hash: 6b585d0d2f97ecae9b608ac83cec5dcabd445bfd677a5aae273422d8861c5475a3c0d9732d0bb1bbd13b1ad6bd68ad0f
SHA1 hash: ab9ceee31499df70a346c327177375ab105e85f6
MD5 hash: 7b586d66c7ad582e5a085edf6b9cafb1
humanhash: mars-tennessee-carolina-moon
File name:LM_QUOTE757860PDF.IMG
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'310'720 bytes
First seen:2021-04-01 07:21:51 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:ggEqG3ulqzfg4QkEVzd2BCDMDEw7pQ6Dfcw9NnfH8enx+SBdf0il5QSJ7pp1uXzH:+7g4azfwpqsVO
TLSH C95528AD325076EFC867C972CA981C64EBA0747B930BD243A01716ADEE4D997DF140F2
Reporter abuse_ch
Tags:img RedLineStealer


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: lefiell.com
Sending IP: 96.239.35.74
From: Pauline Simmons<saleskst@lefiell.com>
Subject: Quote Request
Attachment: LM_QUOTE757860PDF.IMG (contains "LM_QUOTE757860PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.576-3.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cac62fa71e5789c01000d09ad82796e8dc4ba029896dfa21d7beddf683c05dcf/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-01 07:22:15 UTC
AV detection:
8 of 44 (18.18%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zldc7jy6k6e4aeaa2cnnqj4w5doexibjrfw7uioxx3o7na6alxhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/cac62fa71e5789c01000d09ad82796e8dc4ba029896dfa21d7beddf683c05dcf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RedLineStealer

img cac62fa71e5789c01000d09ad82796e8dc4ba029896dfa21d7beddf683c05dcf

(this sample)

RedLineStealer

Executable exe b703fc1fc9dbeb8369aa579ea718f9e02c05cfcac32a46bfbe764f7171849643

  
Dropping
MD5 e0a4f1a1d575c630143bb10ca3f95a4c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b703fc1fc9dbeb8369aa579ea718f9e02c05cfcac32a46bfbe764f7171849643

Comments