MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa506d036fb331533677b7c7a2f3a0d9c799c715ea3c6668b09fe1b0c193b8c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa506d036fb331533677b7c7a2f3a0d9c799c715ea3c6668b09fe1b0c193b8c6
SHA3-384 hash: 98ae82162a5ea4a7eb1ac391365b6f87a2c540118804a386f4f52a9a13f42a0ea3a725429f39abf9b56fd1cf55a0187e
SHA1 hash: 884b52ad9ed2e15de6ded0a2619a827eca0b8924
MD5 hash: abcdcfed88dba115f1e597e7930571bf
humanhash: lion-bluebird-glucose-gee
File name:WeInstaller.zip
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:15'390'380 bytes
First seen:2023-01-05 20:37:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: 4399
ssdeep 393216:+IAu0D6CcK2kPnIIgmbAmC4KqbaHawO4IzbOJe6:zAuw+LynIubAZ4/cawO4+CF
TLSH T172F633B7D7773E40408D49FFADD861CC90B5E8BBEE7500E259628112295BBF8F089399
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter Zacinquarantine
Tags:4399 Pw-4399 Redline RedLineStealer zip


Avatar
Zacinquarantine
https://tria.ge/230105-yzczgagg2w

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
CA CA
File Archive Information

This file archive contains 24 file(s), sorted by their relevance:

File name:2 (4).dll
File size:12'240 bytes
SHA256 hash: b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607
MD5 hash: 7a859e91fdcf78a584ac93aa85371bc9
MIME type:application/x-dosexec
Signature RedLineStealer
File name:MEM (14).dll
File size:1'060'675 bytes
SHA256 hash: dd8634c6002a8afbf77a68222cf3ec6f9d0650420898b7f8f66ec590799149eb
MD5 hash: bc2a751caf2023d8138d05db468268bd
MIME type:application/x-dosexec
Signature RedLineStealer
File name:v3 (2).dll
File size:12'752 bytes
SHA256 hash: f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f
MD5 hash: 8906279245f7385b189a6b0b67df2d7c
MIME type:application/x-dosexec
Signature RedLineStealer
File name:api-ms-win-core-synch-l1-2-0.dll
File size:12'240 bytes
SHA256 hash: 72c639d1afda32a65143bcbe016fe5d8b46d17924f5f5190eb04efe954c1199a
MD5 hash: e86cfc5e1147c25972a5eefed7be989f
MIME type:application/x-dosexec
Signature RedLineStealer
File name:api-ms-win-core-timezone-l1-1-0.dll
File size:12'240 bytes
SHA256 hash: b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34
MD5 hash: 91a2ae3c4eb79cf748e15a58108409ad
MIME type:application/x-dosexec
Signature RedLineStealer
File name:api-ms-win-crt-process-l1-1-0.dll
File size:12'752 bytes
SHA256 hash: 3af38920e767bd9ebc08f88eaf2d08c748a267c7ec60eab41c49b3f282a4cf65
MD5 hash: 074b81a625fb68159431bb556d28fab5
MIME type:application/x-dosexec
Signature RedLineStealer
File name:v3 (5).dll
File size:19'920 bytes
SHA256 hash: 7101b3dff525ea47b7a40dd96544c944ae400447df7a6acd07363b6d7968b889
MD5 hash: b5c8af5badcdefd8812af4f63364fe2b
MIME type:application/x-dosexec
Signature RedLineStealer
File name:MEM (15).dll
File size:64'464 bytes
SHA256 hash: 785c49fd9f99c6eb636d78887aa186233e9304921dd835dee8f72e2609ff65c4
MD5 hash: d76e7aaecb3d1ca9948c31bdae52eb9d
MIME type:application/x-dosexec
Signature RedLineStealer
File name:MEM (11).dll
File size:20'944 bytes
SHA256 hash: a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0
MD5 hash: a6a3d6d11d623e16866f38185853facd
MIME type:application/x-dosexec
Signature RedLineStealer
File name:v3 (1).dll
File size:13'776 bytes
SHA256 hash: 7102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86
MD5 hash: 972544ade7e32bfdeb28b39bc734cdee
MIME type:application/x-dosexec
Signature RedLineStealer
File name:api-ms-win-core-util-l1-1-0.dll
File size:11'728 bytes
SHA256 hash: f28a8fe2cd7e8e00b6d2ec273c16db6e6eea9b6b16f7f69887154b6228af981e
MD5 hash: 1e4c4c8e643de249401e954488744997
MIME type:application/x-dosexec
Signature RedLineStealer
File name:data3.dll
File size:17'872 bytes
SHA256 hash: f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb
MD5 hash: 55b2eb7f17f82b2096e94bca9d2db901
MIME type:application/x-dosexec
Signature RedLineStealer
File name:cef.pak
File size:1'961'998 bytes
SHA256 hash: e95c9c02fc5a679765f61f9839efdc685df3f84dbf24a5a71958b9c0ad1c1212
MD5 hash: 43ffabe9e94750f81204e6d9b2444503
MIME type:application/octet-stream
Signature RedLineStealer
File name:api-ms-win-core-synch-l1-1-0.dll
File size:13'776 bytes
SHA256 hash: d6708d1254ed88a948871771d6d1296945e1aa3aeb7e33e16cc378f396c61045
MD5 hash: 4ccde2d1681217e282996e27f3d9ed2e
MIME type:application/x-dosexec
Signature RedLineStealer
File name:MEM (9).dll
File size:12'240 bytes
SHA256 hash: 2eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e
MD5 hash: dd8176e132eedea3322443046ac35ca2
MIME type:application/x-dosexec
Signature RedLineStealer
File name:v3 (8).dll
File size:15'824 bytes
SHA256 hash: 5cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639
MD5 hash: 4ec4790281017e616af632da1dc624e1
MIME type:application/x-dosexec
Signature RedLineStealer
File name:2 (2).dll
File size:12'752 bytes
SHA256 hash: e677497c1baefffb33a17d22a99b76b7fa7ae7a0c84e12fda27d9be5c3d104cf
MD5 hash: fa770bcd70208a479bde8086d02c22da
MIME type:application/x-dosexec
Signature RedLineStealer
File name:ADD.dll
File size:14'288 bytes
SHA256 hash: b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0
MD5 hash: 1d48a3189a55b632798f0e859628b0fb
MIME type:application/x-dosexec
Signature RedLineStealer
File name:data2.dll
File size:12'240 bytes
SHA256 hash: dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1
MD5 hash: dbc27d384679916ba76316fb5e972ea6
MIME type:application/x-dosexec
Signature RedLineStealer
File name:api-ms-win-core-sysinfo-l1-1-0.dll
File size:12'768 bytes
SHA256 hash: 76d8e4ed946deefeefa0d0012c276f0b61f3d1c84af00533f4931546cbb2f99e
MD5 hash: 206adcb409a1c9a026f7afdfc2933202
MIME type:application/x-dosexec
Signature RedLineStealer
File name:data1.dll
File size:16'336 bytes
SHA256 hash: d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198
MD5 hash: f1a23c251fcbb7041496352ec9bcffbe
MIME type:application/x-dosexec
Signature RedLineStealer
File name:cef_100_percent.pak
File size:268'570 bytes
SHA256 hash: 2c0b60f8cfd3fd1a09e0baae6954f3eb424b161ba85d8a6878bfa51547a03426
MD5 hash: 9db96c13fa9c1c0ee63145665783798e
MIME type:application/octet-stream
Signature RedLineStealer
File name:winmm.dll
File size:11'728 bytes
SHA256 hash: f3a7a9c98ebe915b1b57c16e27fffd4ddf31a82f0f21c06fe292878e48f5883e
MD5 hash: c9cbad5632d4d42a1bc25ccfa8833601
MIME type:application/x-dosexec
Signature RedLineStealer
File name:setup.exe
File size:13'117'377 bytes
SHA256 hash: 5dfc270f4ab0582f5718784c455623755d8fb7a22a2e8db4d98be5ecb913352c
MD5 hash: d7ac9f5311f60a1e99d3547d66f19a4d
MIME type:application/x-dosexec
Signature RedLineStealer
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/fa506d036fb331533677b7c7a2f3a0d9c799c715ea3c6668b09fe1b0c193b8c6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa506d036fb331533677b7c7a2f3a0d9c799c715ea3c6668b09fe1b0c193b8c6/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7jig2a3pwmyvgntxw7d2f45a3hdztryv5i6gm2fqt7q3bqmtxdda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

zip fa506d036fb331533677b7c7a2f3a0d9c799c715ea3c6668b09fe1b0c193b8c6

(this sample)

RedLineStealer

Executable exe 5dfc270f4ab0582f5718784c455623755d8fb7a22a2e8db4d98be5ecb913352c

Malpedia
Malpedia
https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
  
Dropping
SHA256 5dfc270f4ab0582f5718784c455623755d8fb7a22a2e8db4d98be5ecb913352c
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2498563/

Comments