redline

General

Target

Fortnite Hack Mod v1.4.exe
Size

6.0MB
Sample

211205-r7lg9acedq
MD5

2bc87a9ad768070676676654252ebdae
SHA1

e769f41e2b36b7326b692c27fa8555d55e3fdcb4
SHA256

07de0324fd15b8dab3b0c9e4345a2ecc0d2bc0c806f6702cda99e480e9d6506c
SHA512

ef86cec20badf91e48e9ce60d93618235dcd3fcc274d463b2950c5ed81cbcf8fc8268efd9493a5257783497c547c298ca64ab620fad11c3be24b2f03c7e14418

Score

10^/10

Malware Config

Targets

- Target
  
  Fortnite Hack Mod v1.4.exe
- Size
  
  6.0MB
- MD5
  
  2bc87a9ad768070676676654252ebdae
- SHA1
  
  e769f41e2b36b7326b692c27fa8555d55e3fdcb4
- SHA256
  
  07de0324fd15b8dab3b0c9e4345a2ecc0d2bc0c806f6702cda99e480e9d6506c
- SHA512
  
  ef86cec20badf91e48e9ce60d93618235dcd3fcc274d463b2950c5ed81cbcf8fc8268efd9493a5257783497c547c298ca64ab620fad11c3be24b2f03c7e14418
Score

10^/10

redline discovery evasion infostealer persistence spyware stealer trojan upx
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2