MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd4cb9d6bbef97d3e35c33b5e1ef096e84c29ffc288beea73ca7cfadda6da2d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd4cb9d6bbef97d3e35c33b5e1ef096e84c29ffc288beea73ca7cfadda6da2d2
SHA3-384 hash: 2e87f6b8a0b311317bc9d50fcc945c9784dcb30d4fc11bfbb8b1bcac95446411c8094a16f10e20265cb3333a9fa699cd
SHA1 hash: f3441dc79521f5c33d9a52b70c658623354a0942
MD5 hash: 700899aa34731b3971651b1daed09f64
humanhash: zebra-friend-south-emma
File name:K25004 Chin Bee Road Piling Layout.zip
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:687'440 bytes
First seen:2025-03-28 11:02:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:y1d4O7fSGWbIRo3EYCUXyqeLY74hFMiOQsvpp/9YavT3Oa:yjTfrWEW3EY8W7qFrQT/9YW3Oa
TLSH T181E4231828A10D18C44C8CD9BE8D089D7ABC83E65696FC45B397DCBFCE9D5B7C9480B9
Magika zip
Reporter cocaman
Tags:QUOTATION RedLineStealer zip


Avatar
cocaman
Malicious email (T1566.001)
From: "HEN JONG CHENG <henjc@keonghong.com>" (likely spoofed)
Received: "from [195.211.191.34] (unknown [195.211.191.34]) "
Date: "27 Mar 2025 23:00:18 -0700"
Subject: "FW: Chin Bee A&A Works - Request Quotation for Piling Works - RC Piles (Hiap Seng piling)"
Attachment: "K25004 Chin Bee Road Piling Layout.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
346
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:K25004 Chin Bee Road Piling Layout.exe
File size:1'105'920 bytes
SHA256 hash: 4b3fb4c8594eec8feffeb0955e3103e6211086450e5fa202b4188de5c9179960
MD5 hash: c1523e38552e62abe928da077238703b
MIME type:application/x-dosexec
Signature RedLineStealer
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.vh.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67e6089575b5aed0174e2fbd
Tags:
autoit emotet
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/cd4cb9d6bbef97d3e35c33b5e1ef096e84c29ffc288beea73ca7cfadda6da2d2/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit compiled-script evasive explorer fingerprint hacktool keylogger lolbin microsoft_visual_cc msiexec packed packed packer_detected regsvr32
Link:
https://www.filescan.io/uploads/67e681ee6a150b67eec813ef/reports/69f0c370-707b-4110-a2d6-5d6d0a62fe6d/overview
Verdict:
Malicious
Labled as:
Malware.U.Generic
Link:
https://www.hybrid-analysis.com/sample/cd4cb9d6bbef97d3e35c33b5e1ef096e84c29ffc288beea73ca7cfadda6da2d2
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/cd4cb9d6bbef97d3e35c33b5e1ef096e84c29ffc288beea73ca7cfadda6da2d2
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/cd4cb9d6bbef97d3e35c33b5e1ef096e84c29ffc288beea73ca7cfadda6da2d2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd4cb9d6bbef97d3e35c33b5e1ef096e84c29ffc288beea73ca7cfadda6da2d2/
Threat name:
Win32.Spyware.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-03-28 02:25:27 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
20 of 24 (83.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zvgltvv356l5hy24go26d3yjn2cmfh74fcf65jz4u7h23wtnulja._file
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery keylogger stealer
Link:
https://tria.ge/reports/250328-qlhnsswwhz/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
VIPKeylogger
Vipkeylogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot7341655920:AAEZHIUvwdNfcPot5ywEeoVPxGPDy0dAzVs/sendMessage?chat_id=7128988401
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cd4cb9d6bbef97d3e35c33b5e1ef096e84c29ffc288beea73ca7cfadda6da2d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:Suspicious_Latam_MSI_and_ZIP_Files
Create hunting rule
Author:eremit4, P4nd3m1cb0y
Description:Detects suspicious .msi and .zip files used in Latam banking trojan campaigns.
Rule name:SUSP_Imphash_Mar23_3
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:Internal Research
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:testing_win_formbook_autoit
Create hunting rule
Author:dubfib
Rule name:win_samsam_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RedLineStealer

zip cd4cb9d6bbef97d3e35c33b5e1ef096e84c29ffc288beea73ca7cfadda6da2d2

(this sample)

RedLineStealer

Executable exe 4b3fb4c8594eec8feffeb0955e3103e6211086450e5fa202b4188de5c9179960

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4b3fb4c8594eec8feffeb0955e3103e6211086450e5fa202b4188de5c9179960
  
Dropping
MD5 c1523e38552e62abe928da077238703b

Comments