MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9ce53fa50e1e0abf00366fc843f48353c25f21f4522a3c8f71cde705f20acea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 18

Intelligence 18 IOCs YARA 19 File information Comments

SHA256 hash:	c9ce53fa50e1e0abf00366fc843f48353c25f21f4522a3c8f71cde705f20acea
SHA3-384 hash:	12384ede572fcc35e8f7628bc2c4f9743344b44b1708166b4234553f1d8b6cb46ed90a7d4fea9f8be2c05229db1424f5
SHA1 hash:	ef629db680ebcfd5b015f2057e60a2f4062552b1
MD5 hash:	42c3244cdf0f63c215b8159c951fea6a
humanhash:	glucose-pip-wisconsin-london
File name:	jxl.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	744'960 bytes
First seen:	2025-08-02 01:14:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	12288:/NH4zFyU4Ec06HdDyx7rayv2mmQLltC0+PG+YtCekeK:/NYzJPc06Hue1mLltC1G+ACe
Threatray	1'144 similar samples on MalwareBazaar
TLSH	T19CF40128EE23E502F41463770761EA7872A45DBD91C1C6B27EF4EEDBB16E6040F63252
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	4c36f2cca3dc949c (7 x SnakeKeylogger, 2 x MassLogger, 2 x a310Logger)
Reporter	kafan_shengui
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

jxl.exe

Verdict:

Malicious activity

Analysis date:

2025-08-02 01:15:00 UTC

Tags:

auto-sch-xml redline

Link:

https://app.any.run/tasks/0eef64e9-abcd-41b6-995f-52cbb679eaf0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/18391/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=688d66930b4775fb2134df7d

Tags:

redline virus micro spawn

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Сreating synchronization primitives

Creating a process with a hidden window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Launching a process

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Connection attempt to an infection source

Sending a TCP request to an infection source

Adding an exclusion to Microsoft Defender

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 bitmap lolbin msbuild obfuscated packed packed reconnaissance redline regsvcs rezer0 roboski schtasks stealer stego vbc windows

Link:

https://www.filescan.io/uploads/688d66b473b8ef6f4afab5f6/reports/07770089-25ce-4544-b2db-82db4a80aa06/overview

Verdict:

Malicious

Labled as:

Genie.8DN.Generic

Link:

https://www.hybrid-analysis.com/sample/c9ce53fa50e1e0abf00366fc843f48353c25f21f4522a3c8f71cde705f20acea

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/411853b4-3c5a-4c70-a4eb-7a896d67b025

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c9ce53fa50e1e0abf00366fc843f48353c25f21f4522a3c8f71cde705f20acea

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable PDB Path PE (Portable Executable) SOS: 0.34 Win 32 Exe x86

Link:

https://app.malva.re/file/42c3244cdf0f63c215b8159c951fea6a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c9ce53fa50e1e0abf00366fc843f48353c25f21f4522a3c8f71cde705f20acea/

Verdict:

Malicious

Threat:

Family.REDLINE

Link:

https://tip.neiki.dev/file/c9ce53fa50e1e0abf00366fc843f48353c25f21f4522a3c8f71cde705f20acea

Threat name:

ByteCode-MSIL.Trojan.BPLogger

Status:

Malicious

First seen:

2025-08-01 11:34:08 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zhhfh6sq4hqkx4adm36iip2igu6cl4q7iurkhshxdtphaxzavtva._file

Verdict:

malicious

Label(s):

redlinestealer

unc_loader_037

RedLineStealer

a40712b73cd11c8dfe6cb16ba2e9f2749f0a9c154ec5d800cd805b1438843253

RedLineStealer

b70e02c6c4248dd1af3c6ed70b9e016592ab30f6020e109767cbdf81b8c70b02

RedLineStealer

error

RedLineStealer

fd310dd65cf99f9392307b0b7fe8e3c4c45ad5019a321107abbfbd9c6c571de0

RedLineStealer

+ 1'134 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:purelog discovery execution infostealer persistence spyware stealer

Link:

https://tria.ge/reports/250802-bmg2bshq6v/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

RedLine

RedLine payload

Redline family

Malware Config

C2 Extraction:

198.55.98.186:1912

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/47335529-b3be-42b0-854d-3ab3ff126cf7

Unpacked files

SH256 hash:

c9ce53fa50e1e0abf00366fc843f48353c25f21f4522a3c8f71cde705f20acea

MD5 hash:

42c3244cdf0f63c215b8159c951fea6a

SHA1 hash:

ef629db680ebcfd5b015f2057e60a2f4062552b1

Link:

https://www.unpac.me/results/d0895219-79c0-4d38-ab49-37b754421220/

SH256 hash:

2a8ec5027b8286c64ad87013a723eed431bcffc637bede5f05d223eea285ba9f

MD5 hash:

ad67066fab45b35f6d9b36608b40734d

SHA1 hash:

282103ac3f9ca928f2d316b2c398bf2438ce20c5

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/d0895219-79c0-4d38-ab49-37b754421220/

SH256 hash:

5a43f6932ca592c49eccc10c8d5147ca8b6368ceb5846055fd1c16e7025e155f

MD5 hash:

7c8ee74e0992a425a9a496396c96e685

SHA1 hash:

6cd79b4a777844f9633056af630c1faa8a87f977

Detections:

redline

MALWARE_Win_MetaStealer

Link:

https://www.unpac.me/results/d0895219-79c0-4d38-ab49-37b754421220/

Parent samples :

881666cfb7700551912b6f0b5ed601d61aa0c81576d53f69a43246b573832f8c
6d8d665ed1c840de96732ee893e4fce02f684b81491b92291fb99d537cd2b933
71cc18003948de6d70cfef8ecad9a10d842c3c24d07488b7b1c040c39755fd2d
c9ce53fa50e1e0abf00366fc843f48353c25f21f4522a3c8f71cde705f20acea
d5a9a7dbe3a40bf7875cf82a4a36537e19334394d9e765f7b87f07a24cc6e5c8

SH256 hash:

967146c82ece78864f1b9fc82ed6d5f4022813c1530e7b5cfde0eddee5ce0305

MD5 hash:

034bc9b16ef9e131e34454cd52685397

SHA1 hash:

af31017ff5a6a0391daf989ea55f8c1fb7fd902f

Link:

https://www.unpac.me/results/d0895219-79c0-4d38-ab49-37b754421220/

Malware family:

RedLine.F

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c9ce53fa50e1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c9ce53fa50e1e0abf00366fc843f48353c25f21f4522a3c8f71cde705f20acea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	detect_Redline_Stealer_V2 Create hunting rule
Author:	Varp0s

Rule name:	GenericRedLineLike Create hunting rule
Author:	Still
Description:	Matches RedLine-like stealer; may match its variants.

Rule name:	MALWARE_Win_MetaStealer Create hunting rule
Author:	ditekSHen
Description:	Detects MetaStealer infostealer

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	redline_stealer_1 Create hunting rule
Author:	Nikolaos 'n0t' Totosis
Description:	RedLine Stealer Payload

Rule name:	RedLine_Stealer_unpacked_PulseIntel Create hunting rule
Author:	PulseIntel
Description:	Detecting unpacked Redline

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Generic_Threat_efdb9e81 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Generic_40899c85 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_RedLineStealer_6dfafd7b Create hunting rule
Author:	Elastic Security

Rule name:	win_redline_stealer_generic Create hunting rule
Author:	dubfib

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/18391/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample