RedLine Stealer malware analysis – f87d57159032

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

328.7 KB · 328,704 B

First seen

2026-10-19 08:16 · 6 days ago

Last seen

2026-10-19 08:16 · 6 days ago

Last analysis

2026-10-19 16:18 · 6 days ago

Hashes

MD5 b28942080b8a748312a3fe374916ad79 Sha1 fbd0bd60739a79944400feba0693747c908a4540 Sha256 f87d5715903295e50a1c3d370d4fdc30be5128907dd660a3c3d96cde95fec7cd Sha384 5dea265a57c0b26f59ba941c960707300bb481f8755b89eb9c5c43d6174b1acc4905361255593d3cac8acb7239c8b87f Sha512 8dbd6f90edd978431c5eb609d34f8817c2277bba912eedbdc39e92c2282bb958ca1441d0a9917fc1cf4099b7e58dc9bf52ef96e842461c5c50ac1d05781fa051 SSDeep 6144:CcDFqBUKlfP/vVUuQjrWMGNrcOzQGXFL:CcEBUKZNzQTGRcY31 TLSH 04649D1877EC9A01C27A4379E9B1C37057B4EC562A52D31B1BC4ECDB3E36B815E80A76

Detection

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

Symbol obfuscation

Low

1 malicious · 12 files

EXEb28942080b8a748312a3fe374916ad79RECORDSTEALER

Structure

BIN.Net Resources

BINResources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>img

Shape pe:exe>pe:rsrc>img

malicious 3 nodes

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
[Configuration Module Name]	Arghuhuhuhu
[Configuration Module Full Name]	Arghuhuhuhu
IP	127.huhuhuhuhuhuhu
ID	dehuhuhuhu
Message
Key
PublicKeyXml
Version	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
[Configuration Module Name]	Arghuhuhuhu
[Configuration Module Full Name]	Arghuhuhuhu
Key
PublicKeyXml
Version	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	RuntimeHost.exe
Full Name	RuntimeHost.exe
EntryPoint	System.Void Program::Main()
Scope Name	RuntimeHost.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	RuntimeHost
Assembly Version	10.0.22432.373
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6.2
Total Strings	380
Main Method	System.Void Program::Main()
Main IL Instruction Count	11
Main IL	`nop <null> nop <null> call System.Void Program2::WriteLine() nop <null> nop <null> leave.s IL_0010: ret pop <null> nop <null> nop <null> leave.s IL_0010: ret ret <null>`