MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f93c05e8f0a7c6c4e6ee7f82da40e66e9aa2191ad87da82da2b0c478a6dac97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 18


Intelligence 18 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f93c05e8f0a7c6c4e6ee7f82da40e66e9aa2191ad87da82da2b0c478a6dac97
SHA3-384 hash: dab8e04291aa6a19d5e747caaacbca3ffa7091a48f9e2359b5959aaae72cd74cbce08017e6ba79ec176923bdfb5dda97
SHA1 hash: 400aaf77497d3e4fc6fc347ac8e8df83367600c5
MD5 hash: 6c856327dcb9f8c341c601867b1622c5
humanhash: uniform-thirteen-maine-iowa
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:201'896 bytes
First seen:2026-01-22 08:59:04 UTC
Last seen:2026-01-22 09:26:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'749 x AgentTesla, 19'653 x Formbook, 12'246 x SnakeKeylogger)
ssdeep 3072:OcZqf7D342p/0+mAckyQWzwQ0gMwB1fA0PuTVAtkxzf3RRbUgQp:OcZqf7DIOnaDxB1fA0GTV8kpbUZ
Threatray 2'759 similar samples on MalwareBazaar
TLSH T160147C5823E8C614EE7F4B75D4A1124597F0F163F947EB0B4FC894AA2D23740EA60AB7
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe fbf543 RedLineStealer


Avatar
Bitsight
url: http://130.12.180.43/files/7154003499/qyCgDyM.exe

Intelligence

File Origin
# of uploads :
7
# of downloads :
132
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
RedLine
Details
RedLine
a c2 address, a missionid, a configuration XOR key, and possibly: a message box, a version, and an authorization token
Link:
https://research.acce.ciphertechsolutions.com/results/4aabdbe5-3741-42ef-a079-d80e34851dbc/
Malware family:
redline
Create hunting rule
ID:
1
File name:
_7f93c05e8f0a7c6c4e6ee7f82da40e66e9aa2191ad87da82da2b0c478a6dac97.exe
Verdict:
Malicious activity
Analysis date:
2026-01-22 09:00:16 UTC
Tags:
redline
Link:
https://app.any.run/tasks/e2f00239-21bd-4624-96ea-9486120a2aa3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/49709/
Detection(s):
Win.Malware.Trojanx-9862538-0
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6971e6f5f3cf908ba5073e32
Tags:
injection obfusc micro
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 installer installer invalid-signature obfuscated reconnaissance redline redline signed stealer windows
Link:
https://www.filescan.io/uploads/6971e6f05db9ae47708d5644/reports/ea90be3c-0f94-483f-a003-d28486b00d11/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/7f93c05e8f0a7c6c4e6ee7f82da40e66e9aa2191ad87da82da2b0c478a6dac97
Result
Gathering data
Verdict:
Unknown
File Type:
Link:
https://opentip.kaspersky.com/7f93c05e8f0a7c6c4e6ee7f82da40e66e9aa2191ad87da82da2b0c478a6dac97/results?tab=lookup
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5047ecbd-1947-4e01-aefb-e81ed2694b94
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7f93c05e8f0a7c6c4e6ee7f82da40e66e9aa2191ad87da82da2b0c478a6dac97
Verdict:
RedLine Stealer
YARA:
11 match(es)
Tags:
.Net Executable Malicious Managed .NET PE (Portable Executable) PE File Layout RAT RECORDSTEALER RedLine Stealer SOS: 0.27 Stealer Win 32 Exe x86
Malware Config
C2 Extraction:
CNC: 127.0.0.1:80
Link:
https://app.malva.re/file/6c856327dcb9f8c341c601867b1622c5
Detection:
redline
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7f93c05e8f0a7c6c4e6ee7f82da40e66e9aa2191ad87da82da2b0c478a6dac97/
Verdict:
Malicious
Threat:
Family.REDLINE
Link:
https://tip.neiki.dev/file/7f93c05e8f0a7c6c4e6ee7f82da40e66e9aa2191ad87da82da2b0c478a6dac97
Threat name:
ByteCode-MSIL.Trojan.RedLineStealz
Create hunting rule
Status:
Malicious
First seen:
2026-01-22 08:59:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p6j4axupbj6gytto474c3jaom3u2uimrvwd5vaw2fmgepctnvslq._file
Verdict:
malicious
Label(s):
redlinestealer
Create hunting rule
Similar samples:
4eb9804a8558edab914ee49e62c0335b6bb77df7c2c0e7bcae1d69aa15180e6c
RedLineStealer
6aefcac9b610a002e37fa3be97de13fdb2dda4b9d1ccda8434cd8994e46d297f
RedLineStealer
d1fc6072f240470c0149a5688e8eb638b7c29cc9f210e8a5c5fc55df9b06491c
RedLineStealer
d5bc325e667d561e33105971e625cc3d931ced9c2cd5cc28a879cd45fd8f7ce5
RedLineStealer
error
RedLineStealer
+ 2'749 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:trousersnake discovery infostealer
Link:
https://tria.ge/reports/260122-kzydhsby2g/
Behaviour
System Location Discovery: System Language Discovery
RedLine
RedLine payload
Redline family
Malware Config
C2 Extraction:
127.0.0.1:80
Unpacked files
SH256 hash:
7f93c05e8f0a7c6c4e6ee7f82da40e66e9aa2191ad87da82da2b0c478a6dac97
MD5 hash:
6c856327dcb9f8c341c601867b1622c5
SHA1 hash:
400aaf77497d3e4fc6fc347ac8e8df83367600c5
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/dc7356ee-89bd-4518-acb8-6e0184469f2d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7f93c05e8f0a7c6c4e6ee7f82da40e66e9aa2191ad87da82da2b0c478a6dac97

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:detect_Redline_Stealer_V2
Create hunting rule
Author:Varp0s
Rule name:GenericRedLineLike
Create hunting rule
Author:Still
Description:Matches RedLine-like stealer; may match its variants.
Rule name:MALWARE_Win_MetaStealer
Create hunting rule
Author:ditekSHen
Description:Detects MetaStealer infostealer
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:redline_stealer_1
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:RedLine Stealer Payload
Rule name:RedLine_Stealer_unpacked_PulseIntel
Create hunting rule
Author:PulseIntel
Description:Detecting unpacked Redline
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:Windows_Generic_Threat_efdb9e81
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Generic_40899c85
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_RedLineStealer_6dfafd7b
Create hunting rule
Author:Elastic Security
Rule name:win_redline_stealer_generic
Create hunting rule
Author:dubfib

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 7f93c05e8f0a7c6c4e6ee7f82da40e66e9aa2191ad87da82da2b0c478a6dac97

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3761879/
Cape
Cape
https://www.capesandbox.com/analysis/49709/

Comments