MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f015cf03b22191ac595069ce9195f85ddd24664c6b1f4454c849479b9da97a67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 4
| SHA256 hash: | f015cf03b22191ac595069ce9195f85ddd24664c6b1f4454c849479b9da97a67 |
|---|---|
| SHA3-384 hash: | 2c44b9665b566850470b194078c45356c6a7fbbb915cbdb5a6d7129af659d5efbc349e50eb32fc5bc243e0ae97398d23 |
| SHA1 hash: | f6d033e35351f189ad29fde4821d80891c4be484 |
| MD5 hash: | 4ebf576ccd688e32e71122d7f8be2d8f |
| humanhash: | may-avocado-quiet-lactose |
| File name: | MsSgrmLpac.zip |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 17'331'618 bytes |
| First seen: | 2023-02-13 19:20:14 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 393216:mm0x5JtryZx3bobCw8eoDr/4U3oDJ3x4Owp:6HtOPo2Heo/y747 |
| TLSH | T157072324F8663661FC4EC1F40AB00EF803E46DB6122F57C422B9746FA727E6DDA64935 |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  iamdeadlyz |
| Tags: | 89-32-41-231 crashreportcdn-dot-com exe RedLineStealer SpacePearl zip |
Iamdeadlyz
From spacepearl.io (fake P2E game - plagiarised contents from multiple sources - fake team)Contains d645f87e9effc9b26c410ee9b7269ec4094c23a7b46d7cee5720be9d630b7029 (persistence - startup folder)
RedLineStealer C&C: 89.32.41.231:10932
Malicious traffic to C&C: crashreportcdn.com
Intelligence
File Origin
# of uploads :
1
# of downloads :
251
Origin country :
n/a
File Archive Information
This file archive contains 1 file(s), sorted by their relevance:
| File name: | MsSgrmLpac.exe |
|---|---|
| File size: | 822'411'264 bytes |
| SHA256 hash: | d645f87e9effc9b26c410ee9b7269ec4094c23a7b46d7cee5720be9d630b7029 |
| MD5 hash: | 291b477e7f7166e3a34be78c476b1028 |
| MIME type: | application/x-dosexec |
| Signature | RedLineStealer |
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Link:
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
File information
The table below shows additional information about this malware sample such as delivery method and external references.
e3d8e24c2741cbdb8a0cd20da683c1df5d9589742bbc1589192a45fc661444ac
RedLineStealer
zip f015cf03b22191ac595069ce9195f85ddd24664c6b1f4454c849479b9da97a67
(this sample)
6606171a825e3f869b1b37e1d36a068a6afedcad4cf19b9cbed317c29d16eebe
Dropped by
SHA256 e3d8e24c2741cbdb8a0cd20da683c1df5d9589742bbc1589192a45fc661444ac
Dropping
SHA256 6606171a825e3f869b1b37e1d36a068a6afedcad4cf19b9cbed317c29d16eebe
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.