MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc14f1e442332012b8c078d6117cb6bde38c51d59aa82778ecf563bbe4e0e8a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 25 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc14f1e442332012b8c078d6117cb6bde38c51d59aa82778ecf563bbe4e0e8a5
SHA3-384 hash: 9b2cff68c462e11c96e15059d90aad0d10bd920b10d4c7796f5190c5903ae23b04e6a0060d7a0b780e13239738521e0a
SHA1 hash: 611ec1bd5f0886d076a71da1093e3330985df8f7
MD5 hash: c3ee58b231cffa28101542dff1ab07e3
humanhash: north-pizza-massachusetts-mexico
File name:Roblox Hack.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:4'167'168 bytes
First seen:2026-08-12 02:34:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 445554923421947cbff896012e27345a (304 x RedLineStealer, 11 x RaccoonStealer, 5 x CoinMiner)
ssdeep 98304:cz0O0n6vgwMKoyQ0M1LRC3dcf9JtSZhBTOiOxXXU:dxKF2183O9JkZHOi+nU
TLSH T1F91633E5D3A2325CD82FCD363A544A07FA485041AB063BBF2A6F5DEB06DC0AEDF15581
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter hexinglarps
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/80608/
Detection(s):
SecuriteInfo.com.Variant.Barys.441377.22532985.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Connection attempt to an infection source
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
asprotect evasive ntkrnl_protector obfuscated packed packed
Link:
https://www.filescan.io/uploads/6a7bdbf763f340ad9d18c5f7/reports/e3b75d4a-2fa0-422d-a747-3a40aac46d5a/overview
Verdict:
Malicious
Labled as:
Barys.Generic
Link:
https://www.hybrid-analysis.com/sample/dc14f1e442332012b8c078d6117cb6bde38c51d59aa82778ecf563bbe4e0e8a5
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-12T00:23:00Z UTC
Last seen:
2026-08-12T02:41:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/dc14f1e442332012b8c078d6117cb6bde38c51d59aa82778ecf563bbe4e0e8a5/results?tab=lookup
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/94477ca8-4060-42d7-98b2-785144db10d5
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/dc14f1e442332012b8c078d6117cb6bde38c51d59aa82778ecf563bbe4e0e8a5
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc14f1e442332012b8c078d6117cb6bde38c51d59aa82778ecf563bbe4e0e8a5/
Threat name:
Win32.Trojan.Racealer
Create hunting rule
Status:
Malicious
First seen:
2022-03-30 00:31:47 UTC
File Type:
PE (Exe)
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3qkpdzccgmqbfogapdlbc7fwxxryyuovtkuco6hm6vr3xzha5csq._file
Verdict:
malicious
Label(s):
RedLineStealer
Create hunting rule
Link:
https://reports.threatray.com/a8f91eff-ef5c-485b-ace3-a689cb77a911
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@valya_kust discovery infostealer
Link:
https://tria.ge/reports/260812-c3asmaxcma/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Family: RedLine
RedLine payload
Malware Config
C2 Extraction:
95.143.179.85:33214
Unpacked files
SH256 hash:
dc14f1e442332012b8c078d6117cb6bde38c51d59aa82778ecf563bbe4e0e8a5
MD5 hash:
c3ee58b231cffa28101542dff1ab07e3
SHA1 hash:
611ec1bd5f0886d076a71da1093e3330985df8f7
Link:
https://www.unpac.me/results/e4d6e3d5-5720-4223-aa8e-b506b1f87c0e/
SH256 hash:
b78331cad05f0789796404bdb789b4487dffad433f0fff6056221bb73fce4e4c
MD5 hash:
a2e18dcec53857212908773f2aef0e8f
SHA1 hash:
21ea6b0ac45b7783f4adac9d7d3e3236fec940ad
Link:
https://www.unpac.me/results/e4d6e3d5-5720-4223-aa8e-b506b1f87c0e/
SH256 hash:
469e7e5baa45a1aea7ad4ed774e767d761a068398ad10bd71f4881e6bd77db49
MD5 hash:
d1c17806a13e875dd9d45d00d0a48600
SHA1 hash:
9f6d06709b531364fdf488a7fc68fed0349ac1d2
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/e4d6e3d5-5720-4223-aa8e-b506b1f87c0e/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dc14f1e44233/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.49
Link:
https://yomi.yoroi.company/submissions/dc14f1e442332012b8c078d6117cb6bde38c51d59aa82778ecf563bbe4e0e8a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ASProtect13321RegisteredAlexeySolodovnikov
Create hunting rule
Author:malware-lu
Rule name:ASProtectv123RC1
Create hunting rule
Author:malware-lu
Rule name:ASProtectv12xNewStrain
Create hunting rule
Author:malware-lu
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:detect_Redline_Stealer_V2
Create hunting rule
Author:Varp0s
Rule name:GenericRedLineLike
Create hunting rule
Author:Still
Description:Matches RedLine-like stealer; may match its variants.
Rule name:infostealer_win_redline_strings
Create hunting rule
Author:Sekoia.io
Description:Finds Redline samples based on characteristic strings
Rule name:MALWARE_Win_MetaStealer
Create hunting rule
Author:ditekSHen
Description:Detects MetaStealer infostealer
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:redline_stealer_1
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:RedLine Stealer Payload
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Win32_Trojan_RedLineStealer
Create hunting rule
Author:Netskope Threat Labs
Description:Identifies RedLine Stealer samples
Reference:deb95cae4ba26dfba536402318154405
Rule name:Windows_Trojan_Generic_40899c85
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_RedLineStealer_3d9371fd
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_RedLineStealer_4df4bcb6
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_RedLineStealer_6dfafd7b
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_RedLineStealer_f07b3cb4
Create hunting rule
Author:Elastic Security
Rule name:win_redline_stealer_generic
Create hunting rule
Author:dubfib

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe dc14f1e442332012b8c078d6117cb6bde38c51d59aa82778ecf563bbe4e0e8a5

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/80608/

Comments