MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b59653f1e2b8dae784ca4211199d2887ea676d27e7af9d057a625cf9281c17e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 20

Intelligence 20 IOCs 1 YARA 25 File information Comments

SHA256 hash:	b59653f1e2b8dae784ca4211199d2887ea676d27e7af9d057a625cf9281c17e0
SHA3-384 hash:	7f3aa4bc816d7a0724effda2ddadff69eb5305762c8a3e15927baab9e5b3654d4cc054832981e94a854091d426bb370c
SHA1 hash:	38b837cc5fe814ca9580f9029386aa405f8e94df
MD5 hash:	8c21b2fbded2faeb6db2e7a20c513cdb
humanhash:	undress-early-blossom-low
File name:	8C21B2FBDED2FAEB6DB2E7A20C513CDB.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	97'792 bytes
First seen:	2026-07-19 21:50:05 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'131 x AgentTesla, 20'159 x Formbook, 12'362 x SnakeKeylogger)
ssdeep	1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2z3tmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzdT8
TLSH	T19DA35D3067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC194E71FA7B865957EF2
TrID	70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
194.156.79.151:55615

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
194.156.79.151:55615	https://threatfox.abuse.ch/ioc/1853948/

Intelligence

File Origin

# of uploads :

# of downloads :

239

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RedLine

Details

Link:

https://research.acce.ciphertechsolutions.com/results/591f91eb-88f9-4620-bdaa-58d66e72465f/

Malware family:

redline

ID:

File name:

b59653f1e2b8dae784ca4211199d2887ea676d27e7af9d057a625cf9281c17e0.zip

Verdict:

Malicious activity

Analysis date:

2026-07-20 02:55:38 UTC

Tags:

arch-exec stealer redline lefthook

Link:

https://app.any.run/tasks/8c66e37a-6bda-43cd-9241-d956356fca3a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/75221/

Detection(s):

Sanesecurity.Malware.28889.FZF.UNOFFICIAL

Win.Malware.Bulz-9880537-0

Win.Packed.Bulz-9883367-0

Win.Packed.Generickdz-9885340-0

Win.Packed.Bulz-9891195-0

Win.Trojan.Redline-9938775-1

YARA.SEKOIA_Infostealer_Win_Redline_Strings.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5d46b1bcffb2c48cb7953b

Tags:

infosteal redline reline

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Connecting to a non-recommended domain

Connection attempt

Sending an HTTP POST request

DNS request

Launching a service

Sending a custom TCP request

Creating a file

Changing a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm base64 fingerprint hacktool obfuscated redlinestealer stealer stealer

Link:

https://www.filescan.io/uploads/6a5d46ab581634b7b00ae9a2/reports/d920ee9d-fbd1-4224-98c6-6de355ae1547/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/b59653f1e2b8dae784ca4211199d2887ea676d27e7af9d057a625cf9281c17e0

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-07-17T03:47:00Z UTC

Last seen:

2026-07-21T16:38:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/b59653f1e2b8dae784ca4211199d2887ea676d27e7af9d057a625cf9281c17e0/results?tab=lookup

Malware family:

RedLine Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f97f4890-4a80-4362-8c1f-37f475496ca3

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1944892

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b59653f1e2b8dae784ca4211199d2887ea676d27e7af9d057a625cf9281c17e0

Verdict:

RedLine Stealer

YARA:

10 match(es)

Tags:

.Net Executable Malicious Managed .NET PE (Portable Executable) PE File Layout RAT RECORDSTEALER RedLine Stealer SOS: 0.22 Stealer Win 32 Exe x86

Link:

https://app.malva.re/file/8c21b2fbded2faeb6db2e7a20c513cdb

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b59653f1e2b8dae784ca4211199d2887ea676d27e7af9d057a625cf9281c17e0/

Threat name:

ByteCode-MSIL.Ransomware.RedLine

Status:

Malicious

First seen:

2026-07-17 13:51:00 UTC

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wwlfh4pcxdnopbgkiiirthjiq7vgo3jh46xz2bl2mjopska4c7qa._file

Verdict:

malicious

Label(s):

RedLineStealer

Link:

https://reports.threatray.com/77315abe-a746-4d28-814d-65b37cbce00f

RedLineStealer

6bf81a58f47093727e85a5175d3b7042384159ce7088fa94b4476bda09ea401e

RedLineStealer

749af3b59eccdb2c5625afe9fcd959ac667915eeafc79f442617a5ce7612b27a

RedLineStealer

7bed0eed3f423b22cecbfdd23aad0ca8c3b0e8fb5ff0c0402e19e0273f7c27d3

RedLineStealer

851eff1ee63fed8cc3c032689e157ae350dbf68a49a23192bad20277c409d477

RedLineStealer

9fd0eaf75124db45051e5c3b0561b3e8c80af9459fcddf09289698b4acc42096

RedLineStealer

Result

Malware family:

sectoprat

Score:

10/10

Tags:

family:redline family:sectoprat botnet:cheat discovery infostealer rat spyware stealer trojan

Link:

https://tria.ge/reports/260719-1p8phads9l/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

System Location Discovery: System Language Discovery

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Looks up external IP address via web service

Reads user/profile data of web browsers

Family: RedLine

Family: SectopRAT

RedLine payload

SectopRAT payload

Malware Config

C2 Extraction:

194.156.79.151:55615

Unpacked files

SH256 hash:

b59653f1e2b8dae784ca4211199d2887ea676d27e7af9d057a625cf9281c17e0

MD5 hash:

8c21b2fbded2faeb6db2e7a20c513cdb

SHA1 hash:

38b837cc5fe814ca9580f9029386aa405f8e94df

Detections:

triage_redline_infostealer

triage_redlinestealer_infostealer

triage_redlinestealer_rat_crime

Link:

https://www.unpac.me/results/50b9d488-106a-43c8-9881-da6be7e127ea/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b59653f1e2b8dae784ca4211199d2887ea676d27e7af9d057a625cf9281c17e0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	detect_Redline_Stealer_V2 Create hunting rule
Author:	Varp0s

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	infostealer_win_redline_strings Create hunting rule
Author:	Sekoia.io
Description:	Finds Redline samples based on characteristic strings

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	Mal_InfoStealer_Win32_RedLine_Unobfuscated_2021 Create hunting rule
Author:	BlackBerry Threat Research Team
Description:	Detects Unobfuscated RedLine Infostealer Executables (.NET)

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RedLine_a Create hunting rule
Author:	@bartblaze
Description:	Identifies RedLine stealer.

Rule name:	redline_new_bin Create hunting rule
Author:	James_inthe_box
Description:	Redline stealer
Reference:	https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Trojan_Generic_40899c85 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_RedLineStealer_15ee6903 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_RedLineStealer_4df4bcb6 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_RedLineStealer_6dfafd7b Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_RedLineStealer_f07b3cb4 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_RedLineStealer_f54632eb Create hunting rule
Author:	Elastic Security

Rule name:	win_redline_stealer_generic Create hunting rule
Author:	dubfib

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/75221/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample