MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 108bb28df7f64b83f8fda981664c6209a50cab9bb0eb13888410be30d2006bd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	108bb28df7f64b83f8fda981664c6209a50cab9bb0eb13888410be30d2006bd6
SHA3-384 hash:	c0f57ce17d93f4566ef5aa762801a773053f8ace36ef322cd1e7cf75fddd1dfb67e54bea7281a42e0d539c46a60f3c41
SHA1 hash:	24895bc13b1350de60832e4ec5a5fa83c488de54
MD5 hash:	ef45ce3dc054e4ee758167936f6ed8e1
humanhash:	july-juliet-happy-lake
File name:	Xeno-v1.3.30.exe
Download:	download sample
Signature	RedTigerStealer Alert Create hunting rule
File size:	80'071'174 bytes
First seen:	2026-04-16 14:40:42 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	dcaf48c1f10b0efa0a4472200f3850ed (716 x Efimer, 60 x BlankGrabber, 23 x SalatStealer)
ssdeep	1572864:aTIA7mJxw+vWlM9ojCrD4WWJvKSc/JUNnT+O0oZ/hvXvc3m007g+sodvOs:aZmJ5elKbDSc/iFSODhvXvc3yY
TLSH	T14E0833454E41A89BF45EC1338AB48E15E6275CAD1DC15A8B23F809763DB73CC893FA72
TrID	70.9% (.EXE) InstallShield setup (43053/19/16) 10.7% (.EXE) Win64 Executable (generic) (6522/11/2) 8.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.3% (.EXE) OS/2 Executable (generic) (2029/13) 3.3% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	8072e0dba8008104 (1 x RedTigerStealer)
Reporter	burger
Tags:	exe RedTigerStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

165

Origin country :

US

Vendor Threat Intelligence

ACCE PyInstaller

Details

Link:

https://research.acce.ciphertechsolutions.com/results/8ad141c1-20e8-430e-9f74-6505f732c136/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Xeno-v1.3.30.exe

Verdict:

Malicious activity

Analysis date:

2026-04-16 14:38:56 UTC

Tags:

discord evasion stealer anti-evasion python

Link:

https://app.any.run/tasks/ad3ca7e8-4684-48c5-9881-36383ae4fb71

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69e0f456f68adfe1003a70bc

Tags:

extens sage remo

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Sending a custom TCP request

Restart of the analyzed sample

Creating a window

Running batch commands

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Delayed reading of the file

Connection attempt to an infection source

Sending an HTTP GET request

Launching a process

Loading a suspicious library

Query of malicious DNS domain

Sending a TCP request to an infection source

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug expand installer-heuristic lolbin microsoft_visual_cc overlay packed packed pyinstaller stealer virus

Link:

https://www.filescan.io/uploads/69e0f5229124ebc0875418f2/reports/d3f48499-0031-4e70-982e-9eef1adbb9d1/overview

Hybrid Analysis TR/Stealer.BX

Verdict:

Malicious

Labled as:

TR/Stealer.BX

Link:

https://www.hybrid-analysis.com/sample/108bb28df7f64b83f8fda981664c6209a50cab9bb0eb13888410be30d2006bd6

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-04-16T12:16:00Z UTC

Last seen:

2026-04-16T14:09:00Z UTC

Hits:

~10

Detections:

Trojan.Win64.Agent.sb HEUR:Trojan.Python.Tpyc.i HEUR:Trojan.Python.Rodico.gen HEUR:Trojan.Python.Agent.gen Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Disco.sb PDM:Trojan.Win32.Generic HEUR:Trojan.Python.Pytr.t HEUR:Trojan.Python.Pytr.bi HEUR:Trojan-Spy.Python.RedTiger.gen HEUR:Trojan-PSW.Python.Stealer.gen HEUR:Trojan-PSW.Python.Agent.gen

Link:

https://opentip.kaspersky.com/108bb28df7f64b83f8fda981664c6209a50cab9bb0eb13888410be30d2006bd6/results?tab=lookup

Joe Sandbox Discord Token Stealer, RedTiger Stealer

Result

Threat name:

Discord Token Stealer, RedTiger Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1899555

Signature

Found pyInstaller with non standard icon

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal communication platform credentials (via file / registry access)

Yara detected Discord Token Stealer

Yara detected RedTiger Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/108bb28df7f64b83f8fda981664c6209a50cab9bb0eb13888410be30d2006bd6

CERT.PL MWDB

Gathering data

Neiki Family.REDTIGER

Verdict:

Malicious

Threat:

Family.REDTIGER

Link:

https://tip.neiki.dev/file/108bb28df7f64b83f8fda981664c6209a50cab9bb0eb13888410be30d2006bd6

ReversingLabs TitaniumCloud Win64.Trojan.Egairtigado

Threat name:

Win64.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-16 14:38:06 UTC

File Type:

PE+ (Exe)

Extracted files:

2688

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ccf3fdpx6zfyh6h5vgawmtdcbgsqzk43wdvrhceecc7dbuqanpla._file

Hatching Triage redtiger_stealer

Result

Malware family:

redtiger_stealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:redtiger_stealer discovery pyinstaller spyware stealer

Link:

https://tria.ge/reports/260416-r2rr3sd16v/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Browser Information Discovery

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Loads dropped DLL

Reads user/profile data of web browsers

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.