NEW | Hunt across all abuse.ch platforms with one simple query - discover if an IPv4 address, domain, URL or file hash has been identified on any platform from a centralized search tool. Test it out here hunting.abuse.ch - and happy hunting 🔍

YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 83572ca72b578888d7b9996447c892fd498130f83f4118f1aa1fe97828cc5f1e.

Scan Results

SHA256 hash: 83572ca72b578888d7b9996447c892fd498130f83f4118f1aa1fe97828cc5f1e
File size:551'424 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 5ad1ebca105040b84cdf0bf41a4ec067
SHA1 hash: adc08122963b38b6c3439bb49619e07357331fc6
SHA3-384 hash: 6c6ec553c1198bd440f34d3e56f3f3c0b6bdd44fb829207fb3d5007da93d10a87c7dd94cbeaedf34cb9d68f8fd3ab987
First seen:2025-02-08 04:03:38 UTC
Last seen:Never
Sightings:1
imphash : 646167cce332c1c252cdcb1839e0cf48
Create hunting rule
ssdeep : 12288:TMrny90FkrkuzFoxY4Lbw0uRh+8IXV2YE3QVnB9G:wyrdJoxXx/xoCG
TLSH :n/a
telfhash :n/a
gimphash :n/a
File icon (PE):PE icon
dhash icon : f8f0f4c8c8c8d8f0
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:ad4d98e6-e5d1-11ef-86ef-42010aa4000b
File name:5ad1ebca105040b84cdf0bf41a4ec067
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule
Signature:SecuriteInfo.com.Variant.Tedy.277851.28715.14013.UNOFFICIAL
Create hunting rule
Signature:Win.Packed.Lazy-9958163-0
Create hunting rule
Signature:Win.Packed.Pwsx-9988548-0
Create hunting rule
Signature:Win.Trojan.Generic-9933689-0
Create hunting rule
Signature:Win.Trojan.Redline-9938775-1
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:detect_Redline_Stealer
Create hunting rule
Author:Varp0s
TLP:TLP:WHITE
Repository:YARAify
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
TLP:TLP:WHITE
Repository:YARAify
Rule name:win_redline_wextract_hunting_oct_2023
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects wextract archives related to redline/amadey
TLP:TLP:WHITE
Repository:embee-research

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.