redline

General

Target

SecuriteInfo.com.Mal.VMProtBad-A.21942.8290
Size

2.9MB
Sample

201109-97cgfvp5gx
MD5

08750fd649e8084ac1e1db89d96212ee
SHA1

c6adff1321bb62bf47a9265882c91d577b16f47e
SHA256

5bfe42139157de0d0c73ccea8bbf24f8368444cfd5bb4b58300d902bbfa48848
SHA512

3566148b78d24fafe54368940bef0b14ed164ef6482e31c122c55dd8440568b3285ca1e8047f6b4fe75149f3d0bc53c1d63465865c1ff0974b0fdfee25fd4dad

Score

10^/10

Malware Config

Targets

- Target
  
  SecuriteInfo.com.Mal.VMProtBad-A.21942.8290
- Size
  
  2.9MB
- MD5
  
  08750fd649e8084ac1e1db89d96212ee
- SHA1
  
  c6adff1321bb62bf47a9265882c91d577b16f47e
- SHA256
  
  5bfe42139157de0d0c73ccea8bbf24f8368444cfd5bb4b58300d902bbfa48848
- SHA512
  
  3566148b78d24fafe54368940bef0b14ed164ef6482e31c122c55dd8440568b3285ca1e8047f6b4fe75149f3d0bc53c1d63465865c1ff0974b0fdfee25fd4dad
Score

10^/10

redline evasion infostealer themida trojan vmprotect
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- themida
  Detects Themida, Advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

RedLine Payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

VMProtect packed file

Checks BIOS information in registry

themida

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2