Extracted

Extracted

• • Target
    483b1fb169036064fe3e97a40419b570.exe
  • Size 345KB
  • SHA256 ae70b2dbfa535cfa3e910e8635fb2069c41c3bd0da9e66b066374774f5deac4b
  • MD5 483b1fb169036064fe3e97a40419b570
  • SHA1 4592b7c56654ce29b1facb5461ba20529a825fb8
  • SHA512 082f357964efd08e96efa4ffe743a908187f7321cc2aa29d90bd36236f90f1365f25430deccd9ba1e7204141f1f7ee4123a9359a50ce0054e8995ae5d0b58180
  • MD5 SHA1 SHA512

  Score

  10^/10

  smokeloaderbackdoortrojanredlinesewbootkitevasioninfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2