redline

General

Target

http://52.27.7.124/?7c44c8bab4fd4c10d33e0ed7774f4bcdc9056827=f77edc2dc725664cda5c2db7e20cb5eb5659dd20&m=163&q=Avast-Antivirus-2152470-Crack-License-Key-Full-Free-2021&dedica=
Sample

210626-42jzmw6q3a

Score

10^/10

Malware Config

Targets

- Target
  
  http://52.27.7.124/?7c44c8bab4fd4c10d33e0ed7774f4bcdc9056827=f77edc2dc725664cda5c2db7e20cb5eb5659dd20&m=163&q=Avast-Antivirus-2152470-Crack-License-Key-Full-Free-2021&dedica=
Score

10^/10

redline vidar aspackv2 evasion infostealer stealer themida trojan upx
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1