redline

General

Target
fd118cd10923a0d7a58d977fb74295f4.exe
Size 977KB
Sample200709-vmct3k95w6
SHA256 692dc7ac48dfa381cd7f860236876e3621af2e1dc984b8f14cad498e412e88d8
MD5 fd118cd10923a0d7a58d977fb74295f4
SHA1 3e214c12aeb9f54c682dd63fd5e77ac10bc60774
SHA512 549f0e6a5194a6e26d7a2c5b12167d2c0e1fba28d873e077a95462eb3f7d70b3d5fc6f85d0e19b7e5dc5c6b22d74b7a81e56921b9123e8059bdabd7b680e16b6
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  fd118cd10923a0d7a58d977fb74295f4.exe
- Size 977KB
- SHA256 692dc7ac48dfa381cd7f860236876e3621af2e1dc984b8f14cad498e412e88d8
- MD5 fd118cd10923a0d7a58d977fb74295f4
- SHA1 3e214c12aeb9f54c682dd63fd5e77ac10bc60774
- SHA512 549f0e6a5194a6e26d7a2c5b12167d2c0e1fba28d873e077a95462eb3f7d70b3d5fc6f85d0e19b7e5dc5c6b22d74b7a81e56921b9123e8059bdabd7b680e16b6
- MD5 SHA1 SHA512
Score

10^/10

evasion spyware trojan infostealer redline ransomware persistence discovery
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Checks for installed software on the system
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies system certificate store
  evasion spyware trojan
- Modifies service
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2