MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f1271f35cb5bfdb456481302e219e5b8e7341bf1e871bd5f4cdc6636da18929. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 24 File information Comments

SHA256 hash:	4f1271f35cb5bfdb456481302e219e5b8e7341bf1e871bd5f4cdc6636da18929
SHA3-384 hash:	77f5ce8d7249709785a01d80a077cb890a4973bf3b47f36e2670c6e58e64357a5eff46fc46a10512ef997d626ec82ec5
SHA1 hash:	1ade715cb9aff73be53a066f1ff6308f8997e1b2
MD5 hash:	683e2c4091b8947da3a092749bf2c12e
humanhash:	gee-harry-glucose-virginia
File name:	4f1271f35cb5bfdb456481302e219e5b8e7341bf1e871bd5f4cdc6636da18929
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	329'216 bytes
First seen:	2026-10-19 08:08:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
ssdeep	3072:oXMDFq93bh3Injd7mWOCAlfPdNvVU1m2iQeY/A1YWMcoqwYCEw+nrKOzQGXu7MTL:ocDFqTdlfP/vVUuQjrWMGNrKOzQGX9L
TLSH	T1ED649D1877E89A01C27A4379E9B1C37057B4EC562A53D31B1BC4ECDB3E76B814E80A76
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	0000000000000000 (909 x AgentTesla, 577 x Formbook, 319 x RedLineStealer)
Reporter	adrian__luca
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

171

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RedLine

Details

Link:

https://research.acce.ciphertechsolutions.com/results/4a8bf168-e9c2-455e-8829-10710a26cf55/

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-10-19 11:09:29 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/df26f83a-92c3-4092-b41f-ef951933c41d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/92829/

Detection(s):

YARA.DITEKSHEN_MALWARE_Win_Metastealer.UNOFFICIAL

YARA.SEKOIA_Infostealer_Win_Redline_Strings.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad5f0895a22ac805bd7e32a

Tags:

redline stealer virus msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm base64 fingerprint obfuscated reconnaissance redlinestealer redlinestealer stealer

Link:

https://www.filescan.io/uploads/6ad5d031ac2587c2f9861f46/reports/f727fe92-3333-4d82-bea3-bcbeb0683cb7/overview

Verdict:

Malicious

Labled as:

IL:Trojan.MSILZilla

Link:

https://www.hybrid-analysis.com/sample/4f1271f35cb5bfdb456481302e219e5b8e7341bf1e871bd5f4cdc6636da18929

Malware family:

RedLine Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f2a9c384-0223-495d-bfed-b007dace01cc

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/4f1271f35cb5bfdb456481302e219e5b8e7341bf1e871bd5f4cdc6636da18929

Verdict:

RedLine Stealer

YARA:

6 match(es)

Tags:

.Net Executable Malicious Managed .NET PE (Portable Executable) PE File Layout RAT RECORDSTEALER RedLine Stealer SOS: 0.26 Stealer Win 64 Exe x64

Link:

https://app.malva.re/file/683e2c4091b8947da3a092749bf2c12e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4f1271f35cb5bfdb456481302e219e5b8e7341bf1e871bd5f4cdc6636da18929/

Threat name:

ByteCode-MSIL.Spyware.Metastealer

Status:

Malicious

First seen:

2026-09-15 22:15:27 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

24 of 36 (66.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j4jhd424ww75wrleqeyc4im6lohhgqn7d2drxvpuzxdgg3nbreuq._file

Verdict:

malicious

Label(s):

RedLineStealer

Link:

https://reports.threatray.com/ba6ec801-1d3b-44b3-90cc-384e8df7ac1c

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:test infostealer

Link:

https://tria.ge/reports/261019-j2bf4afs5p/

Behaviour

Family: RedLine

RedLine payload

Malware Config

C2 Extraction:

127.0.0.1:1912

Unpacked files

SH256 hash:

4f1271f35cb5bfdb456481302e219e5b8e7341bf1e871bd5f4cdc6636da18929

MD5 hash:

683e2c4091b8947da3a092749bf2c12e

SHA1 hash:

1ade715cb9aff73be53a066f1ff6308f8997e1b2

Detections:

triage_redlinestealer_rat_crime

INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

MALWARE_Win_MetaStealer

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/cd0e2802-17d8-40ae-a21b-1a3d0f729d4c/

SH256 hash:

9ac0f1863b43f2329c040bd084029a9ca63b7e6ef3aca16186b1b30627b8c0fe

MD5 hash:

c9fcc10d4d1da0ac429708435614ae70

SHA1 hash:

b674a77985940060e99b54bb0167c359e78626c8

Link:

https://www.unpac.me/results/cd0e2802-17d8-40ae-a21b-1a3d0f729d4c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4f1271f35cb5bfdb456481302e219e5b8e7341bf1e871bd5f4cdc6636da18929

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BlackGuard_Rule Create hunting rule
Author:	Jiho Kim
Description:	Yara rule for BlackGuarad Stealer v1.0 - v3.0
Reference:	https://www.virustotal.com/gui/file/67843d45ba538eca29c63c3259d697f7e2ba84a3da941295b9207cdb01c85b71/detection

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	detect_Redline_Stealer_V2 Create hunting rule
Author:	Varp0s

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing bas64 encoded gzip files

Rule name:	infostealer_win_redline_strings Create hunting rule
Author:	Sekoia.io
Description:	Finds Redline samples based on characteristic strings

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	MALWARE_Win_MetaStealer Create hunting rule
Author:	ditekSHen
Description:	Detects MetaStealer infostealer

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	redline_stealer_1 Create hunting rule
Author:	Nikolaos 'n0t' Totosis
Description:	RedLine Stealer Payload

Rule name:	RedLine_Stealer_unpacked_PulseIntel Create hunting rule
Author:	PulseIntel
Description:	Detecting unpacked Redline

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Trojan_Generic_40899c85 Create hunting rule
Author:	Elastic Security

Rule name:	WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

Rule name:	win_redline_stealer_generic Create hunting rule
Author:	dubfib

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/92829/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample