Extracted

• • Target
    3d647da17e5d6d7056767f977905eb2b
  • Size 345KB
  • SHA256 f82c86b4d9b27c55326bc2af4e715a473e645deccf2217af82dee93606fb45d2
  • MD5 3d647da17e5d6d7056767f977905eb2b
  • SHA1 a101de222283e7e277a2980547370920b9de1408
  • SHA512 cc0a9fcfe0047a34f13d935a239748fb0682a10272e6ecbea3b679ec87b39b1699b9ccab1ea2c0ff7121114916f79c3e7d2dacf6cba108b2c6123c2fcb448b1c
  • MD5 SHA1 SHA512

  Score

  10^/10

  smokeloaderbackdoortrojanredlinebootkitevasioninfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2