Malicious
Malicious

ca9fe6e7dcc98c0a0a4c98564037dcaf

Share on LinkedIn
Print
PE Executable
MD5: ca9fe6e7dcc98c0a0a4c98564037dcaf
Size: 93.7 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 91.5 KB PE Executable identified by Malva.RE as RedLine Stealer / RECORDSTEALER (rat, stealer). Static analysis extracted 2 embedded or derived files and a malware configuration (RedLine Config.). It matches 7 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
ff7a337d019cbe7812d281e8af9856aa764ff8d4321bb05d162954d1581e512a
MD5
ca9fe6e7dcc98c0a0a4c98564037dcaf
Verdict
Malicious
File type
PE Executable · 91.5 KB
Family
RedLine StealerRECORDSTEALER
Category
RAT, Stealer

Cite this report: https://app.malva.re/sha256/ff7a337d019cbe7812d281e8af9856aa764ff8d4321bb05d162954d1581e512a

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
93.7 KB · 93,696 B
First seen
2026-09-25 06:15 · one month ago
Last seen
2026-09-25 06:15 · one month ago
Last analysis
2026-09-25 06:15 · one month ago
Hashes
MD5 ca9fe6e7dcc98c0a0a4c98564037dcaf Sha1 716d103addea74d8492e269a372759df216df7b9 Sha256 ff7a337d019cbe7812d281e8af9856aa764ff8d4321bb05d162954d1581e512a Sha384 479007bfb94497f1e5a1c6ffad358ee9f7991897670de15aed7e95f9ebf330eb85558ecd00335685b76e04a61ab9ad5e Sha512 29c29c4f32c062c9c0d2c7f69e56b2dc058a19b22e10e7db609c0f038db3970589cd0db8f82e1ade07da7e2e2113ec269a8d5af1327c32dd0059a24f2f4f773c SSDeep 1536:Cqs+nq3zWB16G6jejoigIExoNv+Hf6gi5eubf4kLdRxy7dPf3tmulgS6pR:goIzW+YEkv+7eBLd/y7dAR TLSH DD934D7467DCEF08E6FE16B4A8B2131403F0E4869193FB5E0DC090E91EA7B5299179F2
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

1 malicious · 3 files
EXEca9fe6e7dcc98c0a0a4c98564037dcafRECORDSTEALER
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Config. Field Value
[Configuration Module Name] Enthuhuhuhu
[Configuration Module Full Name] Enthuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
Happy.exe
Full Name
Happy.exe
EntryPoint
System.Void Program::M_2E5B2D2835E7(System.String[])
Scope Name
Happy.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Happy
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
234
Main Method
System.Void Program::M_2E5B2D2835E7(System.String[])
Main IL Instruction Count
3
Main IL 
newobj System.Void EntryPoint::.ctor()
call System.Void Program::Execute(EntryPoint)
ret <null>
Module Name
Happy.exe
Full Name
Happy.exe
EntryPoint
System.Void Program::M_2E5B2D2835E7(System.String[])
Scope Name
Happy.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Happy
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
234
Main Method
System.Void Program::M_2E5B2D2835E7(System.String[])
Main IL Instruction Count
3
Main IL 
newobj System.Void EntryPoint::.ctor()
call System.Void Program::Execute(EntryPoint)
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙