MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f87d5715903295e50a1c3d370d4fdc30be5128907dd660a3c3d96cde95fec7cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 24 File information Comments

SHA256 hash:	f87d5715903295e50a1c3d370d4fdc30be5128907dd660a3c3d96cde95fec7cd
SHA3-384 hash:	f099e847d37dcc548def632501305ab4ec65a1f6ff7392162461a53f97c90aa6a4936394f19329e51db5829858a090b5
SHA1 hash:	fbd0bd60739a79944400feba0693747c908a4540
MD5 hash:	b28942080b8a748312a3fe374916ad79
humanhash:	beryllium-potato-enemy-sixteen
File name:	f87d5715903295e50a1c3d370d4fdc30be5128907dd660a3c3d96cde95fec7cd
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	328'704 bytes
First seen:	2026-10-19 08:08:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
ssdeep	6144:CcDFqBUKlfP/vVUuQjrWMGNrcOzQGXFL:CcEBUKZNzQTGRcY31
TLSH	T104649D1877EC9A01C27A4379E9B1C37057B4EC562A52D31B1BC4ECDB3E36B815E80A76
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	0000000000000000 (909 x AgentTesla, 577 x Formbook, 320 x RedLineStealer)
Reporter	adrian__luca
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

253

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RedLine

Details

Link:

https://research.acce.ciphertechsolutions.com/results/afc953d6-c153-477f-b994-0519dd63a972/

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-10-19 11:20:29 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/fb3976d5-46f5-45f9-a547-2a9603428d4e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/92828/

Detection(s):

YARA.DITEKSHEN_MALWARE_Win_Metastealer.UNOFFICIAL

YARA.SEKOIA_Infostealer_Win_Redline_Strings.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad5f087afb06e650cd7d8b1

Tags:

redline reline

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Sending a custom TCP request

Gathering data

Verdict:

Malicious

Labled as:

IL:Trojan.MSILZilla

Link:

https://www.hybrid-analysis.com/sample/f87d5715903295e50a1c3d370d4fdc30be5128907dd660a3c3d96cde95fec7cd

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-15T17:42:00Z UTC

Last seen:

2026-09-15T18:05:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f87d5715903295e50a1c3d370d4fdc30be5128907dd660a3c3d96cde95fec7cd/results?tab=lookup

Malware family:

RedLine Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/af157136-4a5a-4b5c-9914-a618977df12e

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f87d5715903295e50a1c3d370d4fdc30be5128907dd660a3c3d96cde95fec7cd

Verdict:

RedLine Stealer

YARA:

6 match(es)

Tags:

.Net Executable Malicious Managed .NET PE (Portable Executable) PE File Layout RAT RECORDSTEALER RedLine Stealer SOS: 0.26 Stealer Win 64 Exe x64

Link:

https://app.malva.re/file/b28942080b8a748312a3fe374916ad79

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f87d5715903295e50a1c3d370d4fdc30be5128907dd660a3c3d96cde95fec7cd/

Threat name:

ByteCode-MSIL.Spyware.Metastealer

Status:

Malicious

First seen:

2026-09-17 23:42:37 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

24 of 36 (66.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7b6vofmqgkk6kcq4hu3q2t64gc7fckeqpxlgbi6d3fwn5fp6y7gq._file

Verdict:

malicious

Label(s):

RedLineStealer

Link:

https://reports.threatray.com/7e9993fc-2604-4e09-b6ad-44c483244932

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:default infostealer

Link:

https://tria.ge/reports/261019-j2bf4afs5n/

Behaviour

Family: RedLine

RedLine payload

Malware Config

C2 Extraction:

127.0.0.1:1912

Unpacked files

SH256 hash:

f87d5715903295e50a1c3d370d4fdc30be5128907dd660a3c3d96cde95fec7cd

MD5 hash:

b28942080b8a748312a3fe374916ad79

SHA1 hash:

fbd0bd60739a79944400feba0693747c908a4540

Detections:

triage_redlinestealer_rat_crime

INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

MALWARE_Win_MetaStealer

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/fa9fa557-f9e6-4b3f-bd2a-d047c10636f3/

SH256 hash:

9ac0f1863b43f2329c040bd084029a9ca63b7e6ef3aca16186b1b30627b8c0fe

MD5 hash:

c9fcc10d4d1da0ac429708435614ae70

SHA1 hash:

b674a77985940060e99b54bb0167c359e78626c8

Link:

https://www.unpac.me/results/fa9fa557-f9e6-4b3f-bd2a-d047c10636f3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f87d5715903295e50a1c3d370d4fdc30be5128907dd660a3c3d96cde95fec7cd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BlackGuard_Rule Create hunting rule
Author:	Jiho Kim
Description:	Yara rule for BlackGuarad Stealer v1.0 - v3.0
Reference:	https://www.virustotal.com/gui/file/67843d45ba538eca29c63c3259d697f7e2ba84a3da941295b9207cdb01c85b71/detection

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	detect_Redline_Stealer_V2 Create hunting rule
Author:	Varp0s

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing bas64 encoded gzip files

Rule name:	infostealer_win_redline_strings Create hunting rule
Author:	Sekoia.io
Description:	Finds Redline samples based on characteristic strings

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	MALWARE_Win_MetaStealer Create hunting rule
Author:	ditekSHen
Description:	Detects MetaStealer infostealer

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	redline_stealer_1 Create hunting rule
Author:	Nikolaos 'n0t' Totosis
Description:	RedLine Stealer Payload

Rule name:	RedLine_Stealer_unpacked_PulseIntel Create hunting rule
Author:	PulseIntel
Description:	Detecting unpacked Redline

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Trojan_Generic_40899c85 Create hunting rule
Author:	Elastic Security

Rule name:	WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

Rule name:	win_redline_stealer_generic Create hunting rule
Author:	dubfib

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/92828/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample