General
-
Target
IlusionChecker.7z
-
Size
3.6MB
-
Sample
211205-1argnsfgb4
-
MD5
ffdcbdd06ed59b0c4a507cac8d575913
-
SHA1
de5e9d4384db0866f083db001217373b34451ea6
-
SHA256
eefc3d0a6af3df17b4c97f8404509550aa8eb99b3757a0ba4590c6bce88c96ca
-
SHA512
09765eac9a6f6dd493a6907e20f07e756ae443bdb7a2e10233161e179fc46669fa5796b91df57a3e5cf3607d1f9fb4ab33e002e2b596699115b624f09b3dc5b5
Static task
static1
Behavioral task
behavioral1
Sample
IlusionChecker.7z
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
IlusionChecker.7z
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
IlusionChecker.7z
Resource
win7-en-20211104
Behavioral task
behavioral4
Sample
IlusionChecker.7z
Resource
win10-en-20211014
Behavioral task
behavioral5
Sample
IlusionChecker.7z
Resource
win7-en-20211104
Behavioral task
behavioral6
Sample
IlusionChecker.7z
Resource
win10-en-20211104
Malware Config
Targets
-
-
Target
IlusionChecker.7z
-
Size
3.6MB
-
MD5
ffdcbdd06ed59b0c4a507cac8d575913
-
SHA1
de5e9d4384db0866f083db001217373b34451ea6
-
SHA256
eefc3d0a6af3df17b4c97f8404509550aa8eb99b3757a0ba4590c6bce88c96ca
-
SHA512
09765eac9a6f6dd493a6907e20f07e756ae443bdb7a2e10233161e179fc46669fa5796b91df57a3e5cf3607d1f9fb4ab33e002e2b596699115b624f09b3dc5b5
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-