redline

Resubmissions

29-07-2021 15:09

210729-wzvqb879aa 10

26-07-2021 20:08

210726-9lbbrtep2a 10

26-07-2021 20:05

210726-bdzs4aydgx 9

Sharing

Copy URL

Twitter E-mail

General

Target

Setup.exe
Size

3.2MB
Sample

210729-wzvqb879aa
MD5

6a42e481e8c2f649a854b08cdaf73be4
SHA1

66d7883449483a44232053f77ed1701c3c3ac9e3
SHA256

3f4a6504fe8dc05ff75fe4a3bdf27eb509b2431ebaf4e189c23b9297ea300f19
SHA512

9d4b1d3ffafebf0faebe550f2d3064a1f515b908e049a5aca07b151d8bfe165d545f244bfd3960283a9310c18e50968834dc3fc471258ef8ddf7541e597d87be

Score

10^/10

Malware Config

Targets

- Target
  
  Setup.exe
- Size
  
  3.2MB
- MD5
  
  6a42e481e8c2f649a854b08cdaf73be4
- SHA1
  
  66d7883449483a44232053f77ed1701c3c3ac9e3
- SHA256
  
  3f4a6504fe8dc05ff75fe4a3bdf27eb509b2431ebaf4e189c23b9297ea300f19
- SHA512
  
  9d4b1d3ffafebf0faebe550f2d3064a1f515b908e049a5aca07b151d8bfe165d545f244bfd3960283a9310c18e50968834dc3fc471258ef8ddf7541e597d87be
Score

10^/10

redline discovery evasion infostealer spyware stealer themida trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Reads user/profile data of web browsers

Themida packer

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2