General
-
Target
Vixen Shelter Romance.scr.bin
-
Size
8.7MB
-
Sample
210118-p32ladfv66
-
MD5
0521b0d5f0b688f1e854d385e4fb9ebb
-
SHA1
5180ef4fc778b5a9ff9b7c8ca6f41b500ca0c4d5
-
SHA256
171648fd46a4512cd2475bbd3720869cff6816786e1152080dc71fe60a68a727
-
SHA512
3dfa62a658bf549fe4225061df5d3203723aec6e842e807176a4cb9d7c55e94fe3ad30064f8ec89bb1c0393bb219351c9dac63ddaf0be279a64befc42587a93d
Static task
static1
Behavioral task
behavioral1
Sample
Vixen Shelter Romance.scr.bin.exe
Resource
win7v20201028
Malware Config
Targets
-
-
Target
Vixen Shelter Romance.scr.bin
-
Size
8.7MB
-
MD5
0521b0d5f0b688f1e854d385e4fb9ebb
-
SHA1
5180ef4fc778b5a9ff9b7c8ca6f41b500ca0c4d5
-
SHA256
171648fd46a4512cd2475bbd3720869cff6816786e1152080dc71fe60a68a727
-
SHA512
3dfa62a658bf549fe4225061df5d3203723aec6e842e807176a4cb9d7c55e94fe3ad30064f8ec89bb1c0393bb219351c9dac63ddaf0be279a64befc42587a93d
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-