MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 17

Intelligence 17 IOCs YARA 20 File information Comments

SHA256 hash:	8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd
SHA3-384 hash:	b79e94a06943ece638fc2e016c696ddd4bba4a907c944d2afd3989cbb03ea3831b73f6e89beb2a08eb338240de9b2b16
SHA1 hash:	ff8b0cc9c8554eec5e5c65cc1990418ec812b8f2
MD5 hash:	1130fe776458c3e4f3779a8f037eaa0b
humanhash:	magnesium-alanine-island-violet
File name:	8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	7'394'816 bytes
First seen:	2026-09-06 20:06:08 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'474 x RedLineStealer, 4'855 x Amadey, 290 x Smoke Loader)
ssdeep	196608:TuKsZTLojKaHaPSN1I0F0ekhDd7phctNO/Ecudbv:eBa6KjICLkhDdfIAEcuZ
TLSH	T11176335BF2C6206FFCF9473309F961930725EE710F24959F9A40ACAC29706266EB5372
TrID	39.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 21.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 8.3% (.EXE) Win64 Executable (generic) (6522/11/2) 6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
File icon (PE):
dhash icon	f8f0f4c8c8c8d8f0 (8'804 x RedLineStealer, 5'108 x Amadey, 288 x Smoke Loader)
Reporter	rifteyy
Tags:	Amadey exe lumma RedLineStealer Stealc stealer

Intelligence

File Origin

# of uploads :

# of downloads :

181

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Details

Link:

https://research.acce.ciphertechsolutions.com/results/29571724-13da-4e54-8d51-a8c4191c5f71/

Malware family:

amadey

ID:

File name:

8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd

Verdict:

Malicious activity

Analysis date:

2025-07-18 03:08:12 UTC

Tags:

amadey lumma stealer stealc themida

Link:

https://app.any.run/tasks/3b74d0ac-fc29-4747-88d9-0609d7ef5312

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Amadey

Link:

https://www.capesandbox.com/analysis/84270/

Detection(s):

Sanesecurity.Malware.28840.BadO.UNOFFICIAL

SecuriteInfo.com.Trojan.Lumma-1.UNOFFICIAL

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL

Sanesecurity.Malware.31328.BadINC.UNOFFICIAL

Win.Packed.Zusy-10036805-0

Win.Packed.Zusy-10037550-0

Win.Packed.Zusy-10037551-0

Win.Packed.Zusy-10037840-0

Win.Packed.Zusy-10037925-0

Win.Packed.Zusy-10038401-0

Win.Packed.Zusy-10038404-0

Win.Packed.Zusy-10039059-0

Win.Packed.Zusy-10039868-0

Win.Packed.Redcap-10040665-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Сreating synchronization primitives

Searching for analyzing tools

Searching for the window

Creating a file

Creating a window

Searching for synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Behavior that indicates a threat

Sending a custom TCP request

Deleting a recently created file

Connection attempt to an infection source

Query of malicious DNS domain

Sending a TCP request to an infection source

Enabling autorun by creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-vm CAB evasive explorer installer installer installer-heuristic lolbin lummastealer microsoft_visual_cc packed reconnaissance rundll32 runonce sfx

Link:

https://www.filescan.io/uploads/6a9dc7b77c4a31eee0737731/reports/34d5a2a9-0bf6-4d47-a6ca-625ddded1555/overview

Verdict:

Malicious

Labled as:

Crifi.Generic

Link:

https://www.hybrid-analysis.com/sample/8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd

Verdict:

Malicious

File Type:

exe x32

First seen:

2024-11-28T21:26:00Z UTC

Last seen:

2026-09-06T19:47:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/48670b1f-1922-42e9-abd8-abe25fb627ad

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd

Verdict:

inconclusive

YARA:

6 match(es)

Tags:

.Net CAB:COMPRESSION:LZX Executable PDB Path PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump) Win 32 Exe x86

Link:

https://app.malva.re/file/1130fe776458c3e4f3779a8f037eaa0b

Detection:

lumma

Link:

https://mwdb.cert.pl/sample/8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd/

Threat name:

Win32.Trojan.LummaStealer

Status:

Malicious

First seen:

2024-11-29 05:13:00 UTC

File Type:

PE (Exe)

Extracted files:

122

AV detection:

27 of 36 (75.00%)

Threat level:

5/5

Verdict:

malicious

Label(s):

Amadey

LummaStealer

Link:

https://reports.threatray.com/a13af60e-5b45-4203-acfe-c75cdd7af199

Result

Malware family:

stealc

Score:

10/10

Tags:

family:amadey family:healer family:lumma family:stealc botnet:9c9aa5 botnet:drum defense_evasion discovery dropper evasion persistence stealer trojan

Link:

https://tria.ge/reports/260906-yvjapadb24/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Adds Run key to start application

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Windows security modification

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Detects Amadey x86-bit Payload

Detects Healer an antivirus disabler dropper

Family: Amadey

Family: Healer

Family: Lumma Stealer, LummaC

Family: Stealc

Modifies Windows Defender DisableAntiSpyware settings

Modifies Windows Defender Real-time Protection settings

Modifies Windows Defender TamperProtection settings

Modifies Windows Defender notification settings

Malware Config

C2 Extraction:

http://185.215.113.43
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://atten-supporse.biz/api
http://185.215.113.206

Unpacked files

SH256 hash:

8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd

MD5 hash:

1130fe776458c3e4f3779a8f037eaa0b

SHA1 hash:

ff8b0cc9c8554eec5e5c65cc1990418ec812b8f2

Link:

https://www.unpac.me/results/408bed4c-bcee-42f0-aa50-0293ec549cbc/

SH256 hash:

9749bb8003a500d45b93d70da7016191d9ffcfdb7631a5796127a20f948f9a0c

MD5 hash:

77c08795e026399e9fc87d1a65c912a6

SHA1 hash:

75f1616014e83d19614f4c235fe4809730789937

Detections:

Amadey

win_amadey

Link:

https://www.unpac.me/results/408bed4c-bcee-42f0-aa50-0293ec549cbc/

SH256 hash:

9c866c8648d1882977be5aac6de63a166199cb26c482ebfa3a761a4739ba8ab2

MD5 hash:

308965da803d53cae771199cade46a2c

SHA1 hash:

738c55b2cc40d977c85df6d613516f4ee5b6d34b

Detections:

triage_lumma_infostealer

Link:

https://www.unpac.me/results/408bed4c-bcee-42f0-aa50-0293ec549cbc/

SH256 hash:

1a1f12edfdc2a6115692dc08ae7baeb9aa6dc8de465baaacbe281402a0be3d70

MD5 hash:

f11fc7d1dc95744cd2e7c8372437ac71

SHA1 hash:

a576c6f8fc38a84e36dd6d264df16c3f7da14fb5

Detections:

stealc

Link:

https://www.unpac.me/results/408bed4c-bcee-42f0-aa50-0293ec549cbc/

SH256 hash:

18d26db7f0947e666dbc3e65b165ad0ce621f6269c637a6eb5a258f816686dfc

MD5 hash:

5e6a5679a4ae9a5a634ffda70a6b26e8

SHA1 hash:

5edcc20ae91fbf3ff5d9f8492b5de415621cd852

Link:

https://www.unpac.me/results/408bed4c-bcee-42f0-aa50-0293ec549cbc/

Malware family:

Amadey

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8211468fff3c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Amadey Create hunting rule
Author:	kevoreilly
Description:	Amadey Payload

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Redline_Stealer Create hunting rule
Author:	Varp0s

Rule name:	infostealer_win_stealc_standalone Create hunting rule
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Rule name:	malware_Stealc_str Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	Stealc infostealer

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Stealc Create hunting rule
Author:	kevoreilly
Description:	Stealc Payload

Rule name:	Stealer_Stealc Create hunting rule
Author:	Still
Description:	attempts to match instructions/strings found in Stealc

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	Windows_Generic_Threat_1f2e969c Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Generic_Threat_2bba6bae Create hunting rule
Author:	Elastic Security

Rule name:	win_amadey_a9f4 Create hunting rule
Author:	Johannes Bader
Description:	matches unpacked Amadey samples

Rule name:	win_redline_wextract_hunting_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects wextract archives related to redline/amadey

Rule name:	win_stealc_w0 Create hunting rule
Author:	crep1x
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/