MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 20

Intelligence 20 IOCs YARA 11 File information Comments

SHA256 hash:	fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706
SHA3-384 hash:	f7024e65e657be74776916e7869d3569df9653c5b04c9364443aad15bd4ee2a5340cc1ac926dc8d10bd02d94af31d4c8
SHA1 hash:	293d86892ddec1db5c8ea6fbb3243d817b54e051
MD5 hash:	d1cac8fb7a112aebf2c8c44914646a07
humanhash:	india-orange-utah-mirror
File name:	f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	1'201'152 bytes
First seen:	2025-12-08 15:57:00 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c1ce208b1192bfcf652c179f34f034d3 (37 x AgentTesla, 23 x Formbook, 8 x SnakeKeylogger)
ssdeep	24576:q5EmXFtKaL4/oFe5T9yyXYfP1MAXDzZ0Wxc5koWROHCe:qPVt/LZeJbInGizZ0W2kfu
TLSH	T14945BF0273D1D062FFAB91334F56F6115ABC79260123A62F13981DBABE701B1563E7A3
TrID	50.4% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 19.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.5% (.EXE) Win32 Executable (generic) (4504/4/1) 3.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'698 x Formbook, 1'203 x CredentialFlusher, 928 x AgentTesla)
Reporter	abuse_ch
Tags:	exe RedLineStealer upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	694'272 bytes
File size (de-compressed) :	1'201'152 bytes
Format:	win32/pe
Packed file:	f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641

Intelligence

File Origin

# of uploads :

# of downloads :

239

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

AutoIt

Details

AutoIt

extracted scripts and files

Link:

https://research.acce.ciphertechsolutions.com/results/90b4839c-2a8d-4dfe-9e48-8dcacc83f174/

Malware family:

agenttesla

ID:

File name:

f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641

Verdict:

Malicious activity

Analysis date:

2025-12-09 05:00:36 UTC

Tags:

stealer ultravnc rmm-tool netreactor agenttesla

Link:

https://app.any.run/tasks/047ee9c9-b5c2-41b3-8eee-0785a488a4d1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/43762/

Detection(s):

SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL

PUA.Win.Packer.Embedpe-3

PUA.Win.Packer.AcprotectUltraprotect-1

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6936f5a7881313558a2b9b1e

Tags:

autoit emotet lien

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Reading critical registry keys

Launching a service

Changing a file

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-12-08T17:26:00Z UTC

Last seen:

2025-12-09T19:54:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706/results?tab=lookup

Gathering data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1828956

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Binary is likely a compiled AutoIt script file

Contains functionality to register a low level keyboard hook

Found API chain indicative of sandbox detection

Found malware configuration

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

Verdict:

Malware

YARA:

7 match(es)

Tags:

AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/d1cac8fb7a112aebf2c8c44914646a07

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-12-08 15:57:38 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 38 (73.68%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7uu3za2jopngrhrquu4g3533o6yw5bc5u2524xaofwpkruw2s4da._file

Verdict:

malicious

Label(s):

unc_loader_001

agenttesla

Similar samples:

error

RedLineStealer

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/251208-td7jqszlgj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

AgentTesla

Agenttesla family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/7568ee03-b327-4f73-aa3c-67b043e6b034

Unpacked files

SH256 hash:

c684bbb8caf4359c9d7c598e3c5b8a20363bb0347eaf9c989b95e418ec3bce5e

MD5 hash:

4d924fd00d8de66069d7c17a657b105d

SHA1 hash:

3e8d1ba00a07e4f204442c4d414a3027beec09a4

Detections:

win_samsam_auto

SUSP_OBF_NET_Reactor_Native_Stub_Jan24

MAL_Malware_Imphash_Mar23_1

MetaStealer_NET_Reactor_packer

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/1642749f-8fcf-4704-8c55-e223e151e31e/

Parent samples :

f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641
fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

SH256 hash:

708bd9715efa1b50fd524690be30152520d317903633fabdf1f65d4309bb5288

MD5 hash:

d6634f7a37fff6a6a00a95e87b2edba1

SHA1 hash:

647307855b8c4bacf415425fd4bee351e78638c7

Detections:

AgentTesla

SUSP_OBF_NET_Reactor_Indicators_Jan24

RedLine_Campaign_June2021

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/1642749f-8fcf-4704-8c55-e223e151e31e/

Parent samples :

f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641
fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

SH256 hash:

bfadc806807d2354d0a04db9b72918fca8d4f22a21b724a321dcab576d7775be

MD5 hash:

c714bda197e494fabe681cfe920d7d2b

SHA1 hash:

da1a9e4379a05089978d5737ff93dfd67de891f4

Detections:

AgentTesla

SUSP_OBF_NET_Reactor_Indicators_Jan24

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/1642749f-8fcf-4704-8c55-e223e151e31e/

Parent samples :

f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641
fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

SH256 hash:

fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

MD5 hash:

d1cac8fb7a112aebf2c8c44914646a07

SHA1 hash:

293d86892ddec1db5c8ea6fbb3243d817b54e051

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/1642749f-8fcf-4704-8c55-e223e151e31e/

Parent samples :

f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641
fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fd29bc834973/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	win_samsam_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator