MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9be927e021dd63507b3d8259536f8ed3962df709c3b45fa5853187bb9fc12d21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 21


Intelligence 21 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9be927e021dd63507b3d8259536f8ed3962df709c3b45fa5853187bb9fc12d21
SHA3-384 hash: 1acbc8030378ee5206be64ef8bd51296f2772dc32cde053649b1b7fc90d4144564e7801d9904b739ac5c22a1343f9c03
SHA1 hash: 4f2c037aedb250361a0bb41b95e47be2dfdc3c52
MD5 hash: 0429e093135f1a8ae7b625fdbed6e062
humanhash: lion-yankee-six-ten
File name:0429e093135f1a8ae7b625fdbed6e062.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:913'920 bytes
First seen:2026-04-11 03:55:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'859 x AgentTesla, 19'787 x Formbook, 12'305 x SnakeKeylogger)
ssdeep 24576:ror+2emolYrmrbuRjBc0XMM/0uVYJR7/gmt:r+0TbG60XJ0a6R7/gM
TLSH T1FB15F144B2E8DF02D4A65BF48C71F3B003F51DAD6421E3068EEABDEB7838751585968B
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon f2ceaeaeb2968eaa (75 x RedLineStealer, 22 x AgentTesla, 18 x AveMariaRAT)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
95.211.43.170:55615

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
95.211.43.170:55615 https://threatfox.abuse.ch/ioc/1784112/

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
NL NL
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/74b6ae21-9b8c-47af-a101-957b162cd189/
Malware family:
redline
Create hunting rule
ID:
1
File name:
0429e093135f1a8ae7b625fdbed6e062.exe
Verdict:
Malicious activity
Analysis date:
2026-04-11 03:57:58 UTC
Tags:
stealer redline metastealer lefthook
Link:
https://app.any.run/tasks/0ac76172-9141-4ec1-afd5-6276977b6163

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/61095/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3491.1752.1547.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69d9c63c66ab6d001dd127bd
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Launching a process
Creating a file
Connection attempt
Sending an HTTP POST request
DNS request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypt darkcloud formbook lolbin packed tracker unsafe vbnet xworm
Link:
https://www.filescan.io/uploads/69d9c638c33dc5a985d69cd7/reports/4c76f3fe-7580-423b-b587-2ca79ba5c27c/overview
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/9be927e021dd63507b3d8259536f8ed3962df709c3b45fa5853187bb9fc12d21
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-04-07T13:39:00Z UTC
Last seen:
2026-04-13T02:35:00Z UTC
Hits:
~100
Detections:
Trojan-Spy.Stealer.HTTP.C&C Trojan-PSW.MSIL.Reline.sb Trojan.MSIL.Crypt.sb Trojan.MSIL.Agent.sb Trojan-PSW.MSIL.Stealer.sb Trojan-PSW.MSIL.Reline.c PDM:Trojan.Win32.Generic Trojan-Spy.Stealer.TCP.C&C Backdoor.Agent.HTTP.C&C Trojan.MSIL.Inject.sb HEUR:Trojan.Win32.Generic Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Coins.sb Trojan-PSW.MSIL.Reline.b HEUR:Backdoor.MSIL.XWorm.gen Exploit.CVE-2017-11882.TCP.C&C
Link:
https://opentip.kaspersky.com/9be927e021dd63507b3d8259536f8ed3962df709c3b45fa5853187bb9fc12d21/results?tab=lookup
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/83c91b67-ba9f-4bb1-a10c-90098290db23
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1896791
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9be927e021dd63507b3d8259536f8ed3962df709c3b45fa5853187bb9fc12d21
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9be927e021dd63507b3d8259536f8ed3962df709c3b45fa5853187bb9fc12d21/
Verdict:
Malicious
Threat:
Family.REDLINE
Link:
https://tip.neiki.dev/file/9be927e021dd63507b3d8259536f8ed3962df709c3b45fa5853187bb9fc12d21
Threat name:
Win32.Trojan.DarkCloud
Create hunting rule
Status:
Malicious
First seen:
2026-04-07 15:00:10 UTC
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tpuspybb3vrva6z5qjmvg34o2olc35yjyo2f7jmfggd3xh6bfuqq._file
Verdict:
malicious
Label(s):
offloader
Create hunting rule
redlinestealer
Create hunting rule
Similar samples:
error
RedLineStealer
Result
Malware family:
sectoprat
Create hunting rule
Score:
  10/10
Tags:
family:redline family:sectoprat botnet:cheat discovery infostealer rat spyware trojan
Link:
https://tria.ge/reports/260411-eg386agw6k/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
RedLine
RedLine payload
Redline family
SectopRAT
SectopRAT payload
Sectoprat family
Malware Config
C2 Extraction:
95.211.43.170:55615
Unpacked files
SH256 hash:
9be927e021dd63507b3d8259536f8ed3962df709c3b45fa5853187bb9fc12d21
MD5 hash:
0429e093135f1a8ae7b625fdbed6e062
SHA1 hash:
4f2c037aedb250361a0bb41b95e47be2dfdc3c52
Link:
https://www.unpac.me/results/d4c5f1fd-0023-4cb8-bee9-97784b701104/
SH256 hash:
1b0340c321b1a9513ad03537c91a305ea62c9beb015268ca21e9e9a85afc9f6a
MD5 hash:
920193f9b5449a06b78447403c5828b6
SHA1 hash:
0d6d31ef7bb8808833245f159e6924f4dba73e8d
Detections:
RedLine_a
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
MALWARE_Win_RedLine
Create hunting rule
Link:
https://www.unpac.me/results/d4c5f1fd-0023-4cb8-bee9-97784b701104/
SH256 hash:
3b3e9a25e80165c9318b39f04e57561355f5f69f7b555de1eea25e6e824c5e4a
MD5 hash:
25ec03a146c03f0d376f23e236b021ff
SHA1 hash:
12f400b6df38aae80fd229e92b636a86c36d051b
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/d4c5f1fd-0023-4cb8-bee9-97784b701104/
SH256 hash:
3a70084863d48a2b279192b4fd80baf26c620a6b1a2d9669231cb8aa9de9fcdf
MD5 hash:
e07857f9ede3e4165ade3665858df5f7
SHA1 hash:
526a5f2c6edb57e5c74bb49a07606d95fcd1913a
Link:
https://www.unpac.me/results/d4c5f1fd-0023-4cb8-bee9-97784b701104/
Malware family:
ArechClient2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9be927e021dd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9be927e021dd63507b3d8259536f8ed3962df709c3b45fa5853187bb9fc12d21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/61095/

Comments