General
-
Target
99eb498c965b06069b9badbbca13b3620fb5081010620bd6ebac6e050f5b9803
-
Size
3.2MB
-
Sample
210727-sqdndsfgq6
-
MD5
d704dfedb791137bebd4146f6204d102
-
SHA1
cfd83f9f0acad4ecf67f5bceb6589f106142fe4c
-
SHA256
99eb498c965b06069b9badbbca13b3620fb5081010620bd6ebac6e050f5b9803
-
SHA512
bec027ae7fe820db24fa3334c10f0278dd565c1a680b72ae353b8d713b7edacda485c128d428436c0bcc1df8768a6befbab9a09212478a52481aceef39e06ac8
Static task
static1
Malware Config
Targets
-
-
Target
99eb498c965b06069b9badbbca13b3620fb5081010620bd6ebac6e050f5b9803
-
Size
3.2MB
-
MD5
d704dfedb791137bebd4146f6204d102
-
SHA1
cfd83f9f0acad4ecf67f5bceb6589f106142fe4c
-
SHA256
99eb498c965b06069b9badbbca13b3620fb5081010620bd6ebac6e050f5b9803
-
SHA512
bec027ae7fe820db24fa3334c10f0278dd565c1a680b72ae353b8d713b7edacda485c128d428436c0bcc1df8768a6befbab9a09212478a52481aceef39e06ac8
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-