Overview

overview

10

Static

static

apphost3.exe

windows7_x64

10

apphost3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    apphost3.exe

  • Size

    2.4MB

  • Sample

    201109-ft3pwjysyx

  • MD5

    63c27795d4ec81c0ae682d0ce2dc2bc6

  • SHA1

    841662e430710b633614c23a467027cd49e7dc82

  • SHA256

    f6c756d3b2667ac43f733489fffd65d440ea62da586eb792877dcaab2074873d

  • SHA512

    54f1e5c2afd0d086d047d8a8fcfd68f29cf9ff9560fb74916e9d004302bc1c1ea93b55a5278174092a5fa2a98900300c3166d37f0a0943ee6655ef839b88d739

Score
10/10
redlineevasioninfostealertrojan

Malware Config

Targets

    • Target

      apphost3.exe

    • Size

      2.4MB

    • MD5

      63c27795d4ec81c0ae682d0ce2dc2bc6

    • SHA1

      841662e430710b633614c23a467027cd49e7dc82

    • SHA256

      f6c756d3b2667ac43f733489fffd65d440ea62da586eb792877dcaab2074873d

    • SHA512

      54f1e5c2afd0d086d047d8a8fcfd68f29cf9ff9560fb74916e9d004302bc1c1ea93b55a5278174092a5fa2a98900300c3166d37f0a0943ee6655ef839b88d739

    Score
    10/10
    redlineevasioninfostealertrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks