MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fab45e74fbf938b743767cffaa3273209f65c917c3d025b0913eed0c1e6499a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 17

Intelligence 17 IOCs YARA 13 File information Comments

SHA256 hash:	4fab45e74fbf938b743767cffaa3273209f65c917c3d025b0913eed0c1e6499a
SHA3-384 hash:	1aa2386a380f704600154b9291aba35811a558e019c35c51f45998b69c62e615ae64462308fc112d313e3752fa26b526
SHA1 hash:	667dba5b862dcffb8e4c6acb2945353ced00aace
MD5 hash:	f193053a870cf7bcd939f867a369c000
humanhash:	pennsylvania-oregon-colorado-spaghetti
File name:	Purchase _Order_930586_Pdf.scr
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	1'077'248 bytes
First seen:	2025-08-11 06:19:14 UTC
Last seen:	2025-08-14 11:06:33 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	24576:BjyFoULkDoMF13E0CPMR/asV2D3AoY67pSW50+Ravd6Uv:B2FoCkDoM40CPM4t3AoY6FN0+c6U
TLSH	T11B35CF103FE54D25E4FB8BBA5D909C300B767CD79461D26DA5C9B8CF2C717808EAA31A
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	f2f160b08146c8ca (15 x SnakeKeylogger, 6 x GuLoader, 5 x AgentTesla)
Reporter	adrian__luca
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

Purchase _Order_930586_Pdf.scr

Verdict:

Malicious activity

Analysis date:

2025-08-11 06:22:00 UTC

Tags:

auto-sch-xml evasion stealer ultravnc rmm-tool agenttesla netreactor exfiltration smtp

Link:

https://app.any.run/tasks/25eebd98-9645-45de-b853-c3f9c47d4ea2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/20041/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68998bbcc633abe3908db9c4

Tags:

virus micro lien msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a process with a hidden window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Launching a process

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Adding an exclusion to Microsoft Defender

Enabling autorun by creating a file

Verdict:

Malicious

Labled as:

Barys.Generic

Link:

https://www.hybrid-analysis.com/sample/4fab45e74fbf938b743767cffaa3273209f65c917c3d025b0913eed0c1e6499a

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/29084233-d9e9-4d67-b897-6be327f4c391

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/4fab45e74fbf938b743767cffaa3273209f65c917c3d025b0913eed0c1e6499a

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4fab45e74fbf938b743767cffaa3273209f65c917c3d025b0913eed0c1e6499a/

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/4fab45e74fbf938b743767cffaa3273209f65c917c3d025b0913eed0c1e6499a

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2025-08-07 08:47:51 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

28 of 37 (75.68%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j6vulz2px6jyw5bxm7h7vizhgie7mxerpq6qewyjcpxnbqpgjgna._file

Verdict:

malicious

Label(s):

unc_loader_001

unc_loader_037

Similar samples:

error

RedLineStealer

Result

Malware family:

n/a

Score:

10/10

Tags:

discovery execution persistence spyware stealer

Link:

https://tria.ge/reports/250811-g47k7sgl41/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

SmartAssembly .NET packer

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/0fe764f4-3eee-410f-a566-cbc490aacadc

Unpacked files

SH256 hash:

4fab45e74fbf938b743767cffaa3273209f65c917c3d025b0913eed0c1e6499a

MD5 hash:

f193053a870cf7bcd939f867a369c000

SHA1 hash:

667dba5b862dcffb8e4c6acb2945353ced00aace

Link:

https://www.unpac.me/results/fba60fb3-c66b-4a03-9d87-e04ab9f07b34/

SH256 hash:

5f4a41ae3388863626b03ef3dd208f622dcfed4afeb8047f11578c7c14b00ff2

MD5 hash:

6c9e70de2c8b7d423b6e0b9b094c5158

SHA1 hash:

4c655394c2e93c55b15cf28eb34a4e9e24b9983c

Detections:

win_samsam_auto

SUSP_OBF_NET_Reactor_Native_Stub_Jan24

MAL_Malware_Imphash_Mar23_1

MetaStealer_NET_Reactor_packer

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/fba60fb3-c66b-4a03-9d87-e04ab9f07b34/

SH256 hash:

5c2cac0f3df903e6eea912771e4188f6f20e7b3afc199bc4d577e4133e9298f4

MD5 hash:

68dfe78163e66c4187f6fde1b6fb217c

SHA1 hash:

704c1ca2b7a7cf969fa968d0f2fe3a2a477b9a6c

Detections:

win_samsam_auto

SUSP_OBF_NET_Reactor_Native_Stub_Jan24

MAL_Malware_Imphash_Mar23_1

MetaStealer_NET_Reactor_packer

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/fba60fb3-c66b-4a03-9d87-e04ab9f07b34/

SH256 hash:

40b89fafdb4f6cc3bf9ac5e30a96bffb8c26d2193d88f563ace3b7b2a43ecf7b

MD5 hash:

6f67265f53a008a80dfc6ade45dba6d7

SHA1 hash:

f6c1ee1f5cdb6ee1bb3e2642974b361401cc898d

Detections:

AgentTesla

SUSP_OBF_NET_Reactor_Indicators_Jan24

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/fba60fb3-c66b-4a03-9d87-e04ab9f07b34/

SH256 hash:

925083b7e5d735da0f67d12d724232524311605b4cf5c3b36e3c277b3782bd28

MD5 hash:

dc2e43224e21c43095d5c286d54d53fc

SHA1 hash:

21f32d5aadf71d5150c4a4ea290008afd41c5bbb

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/fba60fb3-c66b-4a03-9d87-e04ab9f07b34/

SH256 hash:

5aec8595300f095f8c20b54f1a405df1d70858033b123e6e0f467c2c0fa17b3f

MD5 hash:

c89589ebc80b2f6018d3577a8e46036f

SHA1 hash:

423e043ac0a1e240b03c68814873e6034e2e9e52

Detections:

win_samsam_auto

SUSP_OBF_NET_Reactor_Native_Stub_Jan24

MAL_Malware_Imphash_Mar23_1

MetaStealer_NET_Reactor_packer

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/fba60fb3-c66b-4a03-9d87-e04ab9f07b34/

Parent samples :

673139dbfbd997edcebfe6d25b8cc2d006c59c752d89a84ef4136f1a5e876db0
9dc0e14b50a2970eb197d9d51803acac4a8ccc722d69dc02d62c1fc6d890346e
bdd6a6c3625c13560f610c7265fca6d99d53cef86054269da6c84c5dfd808539
cd29c558ed0f34d38ccd4f18c8e6923f1c6a9e28ba2328c584a2b6a816bf094e
63cbcf09599c8aa605d4a6781402afa5ddd9ce06c16f0ab5292faf9e63e6ce7d
194eb49397538b9cf6765aa440b8373ac6c2281e1d1906035e6bee727e1bd24b
858a1f71c14ad346a95146debe2df736b00654d971bb884e6932db16404ab973
4fab45e74fbf938b743767cffaa3273209f65c917c3d025b0913eed0c1e6499a
ecb52dcadedb2c2c882454b12bb34aa9246fe33dae55cd0c4947514395e787e3
acbfcd9ecb045c0c91dbb68f41aca01c0d7359c1b752d8bacaa06d232c43933a
05ac057172129bf0315ffcf3b52b478cabea3a61c4548d02cc9b4c1e95aa7497
5bbcc015fb254fe8bbe92dad15a7cf8bfad2aa1715487d535107fd91c4beb3c0
c335602ef52f9260cfb20828515938d3c335abce3e459464d802d4c17d2fe8d7
517f289ea24bf5a5270a83308aff7b392fcd572daea4448978ef7001d53b4a73
d9dd1ad6d094d10dc2ad9b373a5fa5c68be03eebe770471458bbe91fe92c65c7

SH256 hash:

8a0cb1078c36b3b6f7a4107df3f2b0338199997d6171d5892e6ca6386729ab2a

MD5 hash:

eb18e62f475573d7827b3f6217544ca4

SHA1 hash:

440c4e406e0d5ac5b1a6d8636f661b1fef3c8985

Detections:

INDICATOR_EXE_Packed_SmartAssembly

Link:

https://www.unpac.me/results/fba60fb3-c66b-4a03-9d87-e04ab9f07b34/

Parent samples :

dce659de9fd37d5bb82dd72548c0cc74f2498c740013e2cc5573b1b5be47758b
d1a7c0ca70eb4da003a44a8eea966eea7610f21dfcffa7264be2ec56e8dc8591
c2a263cc53bc82d9b66695d8a866d1097a458bc59be40d2ac6b2fb136d2e891c
3ae52f38b463fa450629da184d223a27e5002f72f83e98d584ea3034511d0427
15dd00278c6809c9e476a6e86036f1b752c468d2bdf139fdd453d7d80a5e7459
35a6c90aeed158cbca180d1b3116e6d07cdfdc41731243f01896bec972b99255
5a0211a088e32bc1456d5762c0d09e3e172388a0930fafb94a42f8eee9266c3e
e6278519074f69f35442584cd11ceafbc90f84e9cc9bb8a542b1c39cf253f5bb
cb3c37115d314c01bdc7c55e3d685ca91065842745fdf1b74f73a46be6ef27c6
699b91f69cd0d059794175c55675ad931a2eaa18cb713523265429da6b021633
6f9e7f2f753573b0f2686c72dfb4bd2c174cb5ae9e435f36bb9f4b87145df44a
8b11fcca89381e3f89964db156074fb4d4a00a5b0963010fd9396a2463e84034
b5f7ce31c9333182fd55674e84e7a60e21cfdc92cf6b3b7286be53923a03386c
bbd64c624d3ee6df910c2704ab3040d756550476cb446aaa6147cc4914f89ebe
b6e88036965099c2a668babccab6718f461c41e46139f11f5c95f24bee8bea16
4fab45e74fbf938b743767cffaa3273209f65c917c3d025b0913eed0c1e6499a
08711531856f5bac25163365862fc8a0f2c08eb8d19ea89b4d688f12ef5e841c

SH256 hash:

d7057f5be7a9de9d3bfc27914f791c6922d1034801d508a8852922bf9b160abe

MD5 hash:

1617858269530e8b035289f3986d8053

SHA1 hash:

4c47454460b0eb2f9b3494209826ba61a0a5e63e

Detections:

AgentTesla

SUSP_OBF_NET_Reactor_Indicators_Jan24

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/fba60fb3-c66b-4a03-9d87-e04ab9f07b34/

Parent samples :

SH256 hash:

e6368fd9f0251303da379b645086036326f57f27c0b1fb3e423388d0d174b06d

MD5 hash:

8579d2055a9459ca28a6d162f31202ee

SHA1 hash:

cb95d34021271a70fca78e6b30754c916adcd4c3

Detections:

AgentTesla

SUSP_OBF_NET_Reactor_Indicators_Jan24

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/fba60fb3-c66b-4a03-9d87-e04ab9f07b34/

Parent samples :

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4fab45e74fbf/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4fab45e74fbf938b743767cffaa3273209f65c917c3d025b0913eed0c1e6499a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	win_samsam_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RedLineStealer

exe 4fab45e74fbf938b743767cffaa3273209f65c917c3d025b0913eed0c1e6499a

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/20041/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample