MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7856dc0d9a74e8bccfc47b55b24fe170f568b87feb7a8cb9c54fd81eee0f68d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 24 File information Comments

SHA256 hash:	f7856dc0d9a74e8bccfc47b55b24fe170f568b87feb7a8cb9c54fd81eee0f68d
SHA3-384 hash:	0771047edb5f7fe852b39393900f65f0fc21ac51ea0203abf7785c5ee81042a0e5e25ab6cce8a5fc80ef8aa1cb1195b8
SHA1 hash:	35849158ce2e24dbd14ce444b30fd4507bcd2fd9
MD5 hash:	8cb63ec528985e59a1f67c5527d5adad
humanhash:	indigo-glucose-magazine-september
File name:	f7856dc0d9a74e8bccfc47b55b24fe170f568b87feb7a8cb9c54fd81eee0f68d
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	329'216 bytes
First seen:	2026-10-19 08:10:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
ssdeep	3072:oXMDFq93bh3Injd7mWOCAlfPdNvVU1m2iQeY/A1YWMcoqwYCEw+nrKOzQGcu7MTL:ocDFqTdlfP/vVUuQjrWMGNrKOzQGc9L
TLSH	T111649D1877E89A01C27A4379E9B1C37057B4EC562A53D31B1BC4ECDB3E76B814E80A76
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	0000000000000000 (909 x AgentTesla, 577 x Formbook, 320 x RedLineStealer)
Reporter	adrian__luca
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

522

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RedLine

Details

Link:

https://research.acce.ciphertechsolutions.com/results/c5a528cd-4cd3-428a-89b7-c9d32ef4cc3a/

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-10-19 12:33:32 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/522d16fd-39f3-4169-9280-8313f2b465ce

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/92843/

Detection(s):

YARA.DITEKSHEN_MALWARE_Win_Metastealer.UNOFFICIAL

YARA.SEKOIA_Infostealer_Win_Redline_Strings.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad5f3575a22ac805bd7e3f4

Tags:

redline virus msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Sending a custom TCP request

Gathering data

Verdict:

Malicious

Labled as:

IL:Trojan.MSILZilla

Link:

https://www.hybrid-analysis.com/sample/f7856dc0d9a74e8bccfc47b55b24fe170f568b87feb7a8cb9c54fd81eee0f68d

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-19T06:40:00Z UTC

Last seen:

2026-10-21T03:50:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f7856dc0d9a74e8bccfc47b55b24fe170f568b87feb7a8cb9c54fd81eee0f68d/results?tab=lookup

Malware family:

RedLine Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2dc5434a-6113-4b71-a3f4-664cd6f337b4

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f7856dc0d9a74e8bccfc47b55b24fe170f568b87feb7a8cb9c54fd81eee0f68d

Verdict:

RedLine Stealer

YARA:

6 match(es)

Tags:

.Net Executable Malicious Managed .NET PE (Portable Executable) PE File Layout RAT RECORDSTEALER RedLine Stealer SOS: 0.26 Stealer Win 64 Exe x64

Link:

https://app.malva.re/file/8cb63ec528985e59a1f67c5527d5adad

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f7856dc0d9a74e8bccfc47b55b24fe170f568b87feb7a8cb9c54fd81eee0f68d/

Threat name:

ByteCode-MSIL.Spyware.Metastealer

Status:

Malicious

First seen:

2026-09-15 19:47:39 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

24 of 36 (66.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=66cw3qgzu5hixth4i62vwjh6c4hvnc4h7232rs44kt6yd3xa62gq._file

Verdict:

malicious

Label(s):

RedLineStealer

Link:

https://reports.threatray.com/6110e64c-ec9f-48ef-aa26-79f5fe5467a3

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:test infostealer

Link:

https://tria.ge/reports/261019-j21e8az15l/

Behaviour

Family: RedLine

RedLine payload

Malware Config

C2 Extraction:

127.0.0.1:1912

Unpacked files

SH256 hash:

f7856dc0d9a74e8bccfc47b55b24fe170f568b87feb7a8cb9c54fd81eee0f68d

MD5 hash:

8cb63ec528985e59a1f67c5527d5adad

SHA1 hash:

35849158ce2e24dbd14ce444b30fd4507bcd2fd9

Detections:

triage_redlinestealer_rat_crime

INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

MALWARE_Win_MetaStealer

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/8aaf9a62-4b13-4eca-b68a-ae79f42c6e93/

SH256 hash:

9ac0f1863b43f2329c040bd084029a9ca63b7e6ef3aca16186b1b30627b8c0fe

MD5 hash:

c9fcc10d4d1da0ac429708435614ae70

SHA1 hash:

b674a77985940060e99b54bb0167c359e78626c8

Link:

https://www.unpac.me/results/8aaf9a62-4b13-4eca-b68a-ae79f42c6e93/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f7856dc0d9a74e8bccfc47b55b24fe170f568b87feb7a8cb9c54fd81eee0f68d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BlackGuard_Rule Create hunting rule
Author:	Jiho Kim
Description:	Yara rule for BlackGuarad Stealer v1.0 - v3.0
Reference:	https://www.virustotal.com/gui/file/67843d45ba538eca29c63c3259d697f7e2ba84a3da941295b9207cdb01c85b71/detection

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	detect_Redline_Stealer_V2 Create hunting rule
Author:	Varp0s

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing bas64 encoded gzip files

Rule name:	infostealer_win_redline_strings Create hunting rule
Author:	Sekoia.io
Description:	Finds Redline samples based on characteristic strings

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	MALWARE_Win_MetaStealer Create hunting rule
Author:	ditekSHen
Description:	Detects MetaStealer infostealer

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	redline_stealer_1 Create hunting rule
Author:	Nikolaos 'n0t' Totosis
Description:	RedLine Stealer Payload

Rule name:	RedLine_Stealer_unpacked_PulseIntel Create hunting rule
Author:	PulseIntel
Description:	Detecting unpacked Redline

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Trojan_Generic_40899c85 Create hunting rule
Author:	Elastic Security

Rule name:	WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

Rule name:	win_redline_stealer_generic Create hunting rule
Author:	dubfib

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/92843/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample