Extracted

• • Target
    7b45ecfd38a20fdfdeaf3fe062e11a47
  • Size 192KB
  • SHA256 0cd327d648018f31e5a411a72c839b8b74bb188488a32ddf7289990ae516fa7d
  • MD5 7b45ecfd38a20fdfdeaf3fe062e11a47
  • SHA1 6ec6c203d1fed2cf6a2e3f56c1eed019cc5dcf9c
  • SHA512 c9db100b331dfc069b2b101ae8eb66611ecd1d0b902bbd7804ab8c128f094af3b60b115c1c95018434d754d38ce10de079c666cac87ce439c1c158bb584bcf04
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinesmokeloaderbackdoorevasioninfostealerthemidatrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2