General
-
Target
7186ace185636ae6370b741b93ca8d0f
-
Size
1.4MB
-
Sample
211113-xgb4safda9
-
MD5
7186ace185636ae6370b741b93ca8d0f
-
SHA1
e022fd39851beda080a814c096d294ece89aeff6
-
SHA256
a3d16c6ae1302f54732d0abfcbf0eaece47378a72a35e570ee68bd479bc7c851
-
SHA512
66d882beef9b9fb19b31dc4c880de16d02a9de9a4cf4a529e69c00c32034739e754fe0e4b15033c1a7647c88e42f5923ca2c31077ca855df114dba336a01f6ad
Static task
static1
Behavioral task
behavioral1
Sample
7186ace185636ae6370b741b93ca8d0f.exe
Resource
win7-en-20211014
Malware Config
Extracted
redline
hhh
86.107.197.248:56626
Targets
-
-
Target
7186ace185636ae6370b741b93ca8d0f
-
Size
1.4MB
-
MD5
7186ace185636ae6370b741b93ca8d0f
-
SHA1
e022fd39851beda080a814c096d294ece89aeff6
-
SHA256
a3d16c6ae1302f54732d0abfcbf0eaece47378a72a35e570ee68bd479bc7c851
-
SHA512
66d882beef9b9fb19b31dc4c880de16d02a9de9a4cf4a529e69c00c32034739e754fe0e4b15033c1a7647c88e42f5923ca2c31077ca855df114dba336a01f6ad
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-