MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c93919b24e82d7c32d8e9f2fa7fc5e3138d21a6360752cc79c7f3f0543ced50d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 19


Intelligence 19 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c93919b24e82d7c32d8e9f2fa7fc5e3138d21a6360752cc79c7f3f0543ced50d
SHA3-384 hash: ca7c4dbe28ae48d9de9431e1f3b899b6cfe3d8cc2316c8f7086254c12894ec91dabba148c19d739ea5e2c2b1892ea324
SHA1 hash: 6a5585380d5578bd4f47b3da4fdb40aaf27e3f3a
MD5 hash: 15466030ff72b3d8d13cc121adcd4721
humanhash: march-coffee-july-mirror
File name:15466030ff72b3d8d13cc121adcd4721.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:876'032 bytes
First seen:2026-07-20 17:45:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'122 x AgentTesla, 20'134 x Formbook, 12'360 x SnakeKeylogger)
ssdeep 24576:xR/TwcWmovlpfPeDoEWR2YCeONIPRXG9o:EllpPezWRe/WPROo
TLSH T1A41512A65AEEC513E656177349E1E6B103B4DF88F123C75B9EEC7CEB3912B120842781
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 48d4f4f0f0f0d8c0 (48 x RedLineStealer, 18 x AgentTesla, 12 x RemcosRAT)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
85.17.192.152:55615

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
85.17.192.152:55615 https://threatfox.abuse.ch/ioc/1854467/

Intelligence

File Origin
# of uploads :
1
# of downloads :
229
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
NETReactor RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/7d9ae392-0900-46d0-96b6-bb7a7122344e/
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75456/
Detection(s):
Win.Packed.Boxter-10005643-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5e5ecdbcffb2c48cb7a2af
Tags:
infosteal redline
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Connection attempt
Sending an HTTP POST request
DNS request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Deleting a recently created file
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
agenttesla net_reactor obfuscated packed packed vbnet
Link:
https://www.filescan.io/uploads/6a5e5ec66e5e07f797f51b38/reports/8a1fffea-b6fe-437c-b026-9e8b361ea867/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/c93919b24e82d7c32d8e9f2fa7fc5e3138d21a6360752cc79c7f3f0543ced50d
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-17T05:59:00Z UTC
Last seen:
2026-07-22T06:31:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/c93919b24e82d7c32d8e9f2fa7fc5e3138d21a6360752cc79c7f3f0543ced50d/results?tab=lookup
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/44ee5b6f-a470-4b45-8cd9-2c0916f8ed90
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1945397
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
AI detected malicious Powershell script
Antivirus / Scanner detection for submitted sample
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Yara detected AntiVM3
Yara detected Powershell decode and execute
Yara detected RedLine Stealer
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1945397 Sample: qvTWNZ5XA8.exe Startdate: 20/07/2026 Architecture: WINDOWS Score: 100 60 api.ip.sb.cdn.cloudflare.net 2->60 62 api.ip.sb 2->62 76 Suricata IDS alerts for network traffic 2->76 78 Found malware configuration 2->78 80 Malicious sample detected (through community Yara rule) 2->80 82 17 other signatures 2->82 9 qvTWNZ5XA8.exe 1 7 2->9         started        13 powershell.exe 19 2->13         started        15 powershell.exe 2->15         started        signatures3 process4 file5 48 C:\Users\user\AppData\Roaming\tcUBWL.exe, PE32 9->48 dropped 50 C:\Users\user\...\tcUBWL.exe:Zone.Identifier, ASCII 9->50 dropped 52 C:\Users\user\AppData\...\ljlylqkm35y.ps1, ASCII 9->52 dropped 54 C:\Users\user\AppData\...\qvTWNZ5XA8.exe.log, ASCII 9->54 dropped 88 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->88 90 Found many strings related to Crypto-Wallets (likely being stolen) 9->90 92 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 9->92 94 4 other signatures 9->94 17 qvTWNZ5XA8.exe 15 47 9->17         started        21 powershell.exe 23 9->21         started        23 tcUBWL.exe 3 13->23         started        25 conhost.exe 13->25         started        27 tcUBWL.exe 15->27         started        29 conhost.exe 15->29         started        signatures6 process7 dnsIp8 56 85.17.192.152, 49713, 49720, 49721 LEASEWEB-NL-AMS-01NetherlandsNL Netherlands 17->56 58 api.ip.sb.cdn.cloudflare.net 104.26.13.31, 443, 49719, 49722 CLOUDFLARENET-CloudflareIncUS Canada 17->58 64 Tries to steal Crypto Currency Wallets 17->64 31 conhost.exe 17->31         started        66 Loading BitLocker PowerShell Module 21->66 33 WmiPrvSE.exe 21->33         started        35 conhost.exe 21->35         started        68 Multi AV Scanner detection for dropped file 23->68 70 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 23->70 72 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 23->72 74 Injects a PE file into a foreign processes 23->74 37 tcUBWL.exe 23->37         started        40 tcUBWL.exe 23->40         started        42 tcUBWL.exe 27->42         started        signatures9 process10 signatures11 44 conhost.exe 37->44         started        84 Tries to harvest and steal browser information (history, passwords, etc) 42->84 86 Tries to steal Crypto Currency Wallets 42->86 46 conhost.exe 42->46         started        process12
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c93919b24e82d7c32d8e9f2fa7fc5e3138d21a6360752cc79c7f3f0543ced50d
Verdict:
Malware
YARA:
12 match(es)
Tags:
.Net .Net Obfuscator .Net Reactor Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.62 Win 32 Exe x86
Link:
https://app.malva.re/file/15466030ff72b3d8d13cc121adcd4721
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c93919b24e82d7c32d8e9f2fa7fc5e3138d21a6360752cc79c7f3f0543ced50d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2026-07-17 23:26:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ze4rtmsoqll4glmot4x2p7c6ge4negtdmb2szr44p47qkq6o2ugq._file
Verdict:
malicious
Label(s):
RedLineStealer
Create hunting rule
Link:
https://reports.threatray.com/c985fe82-773b-4d97-97b3-bc419673a6c9
Similar samples:
4b6dcc799cd2d6c6b6ddcef43e8e29bf6fa4ddd676959bd713f093b7143c0b8b
RedLineStealer
6bf81a58f47093727e85a5175d3b7042384159ce7088fa94b4476bda09ea401e
RedLineStealer
749af3b59eccdb2c5625afe9fcd959ac667915eeafc79f442617a5ce7612b27a
RedLineStealer
7bed0eed3f423b22cecbfdd23aad0ca8c3b0e8fb5ff0c0402e19e0273f7c27d3
RedLineStealer
851eff1ee63fed8cc3c032689e157ae350dbf68a49a23192bad20277c409d477
RedLineStealer
9fd0eaf75124db45051e5c3b0561b3e8c80af9459fcddf09289698b4acc42096
RedLineStealer
Result
Malware family:
sectoprat
Create hunting rule
Score:
  10/10
Tags:
family:redline family:sectoprat botnet:cheat discovery execution infostealer persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/260720-wb3h4sby5v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Family: RedLine
Family: SectopRAT
RedLine payload
SectopRAT payload
Malware Config
C2 Extraction:
85.17.192.152:55615
Unpacked files
SH256 hash:
c93919b24e82d7c32d8e9f2fa7fc5e3138d21a6360752cc79c7f3f0543ced50d
MD5 hash:
15466030ff72b3d8d13cc121adcd4721
SHA1 hash:
6a5585380d5578bd4f47b3da4fdb40aaf27e3f3a
Link:
https://www.unpac.me/results/df8cc576-0908-44ae-8af9-c0ab5dddb211/
SH256 hash:
71d9367c8243457fbe9ecb6c980f837a4fdb4b7b339d9de30af3fd3fe1ac8a51
MD5 hash:
d64f146495b3c1d54f854d6f1ebd19b4
SHA1 hash:
08fee7d1064554129ff56d7897f957a06a6b9e2b
Detections:
triage_redline_infostealer
Create hunting rule
triage_redlinestealer_infostealer
Create hunting rule
triage_redlinestealer_rat_crime
Create hunting rule
Link:
https://www.unpac.me/results/df8cc576-0908-44ae-8af9-c0ab5dddb211/
SH256 hash:
281f0a31109ba3566ae24aad9d51a96464ffc1d21e36b6b6772663df2f0faac0
MD5 hash:
dde879de3fd7eb5674e79b43c6f5722d
SHA1 hash:
63a6adfa2f3d970779f8f77c69c9da620b52f3e4
Link:
https://www.unpac.me/results/df8cc576-0908-44ae-8af9-c0ab5dddb211/
SH256 hash:
5174f21c40a3024244b78e026d8838a704ea6cebfb1d53507c20fe985a2d4554
MD5 hash:
777fa5d727eee24acf2772017a2aabb4
SHA1 hash:
a092aab92ce740e121d98754bc04f9030468640f
Link:
https://www.unpac.me/results/df8cc576-0908-44ae-8af9-c0ab5dddb211/
Malware family:
ArechClient2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c93919b24e82/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c93919b24e82d7c32d8e9f2fa7fc5e3138d21a6360752cc79c7f3f0543ced50d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/75456/

Comments