Extracted

• • Target
    a9b14886ee101a248039aa9b60202afd
  • Size 1.6MB
  • SHA256 ca5bd676278cfa46a1630e6d98cf4651a3a3b0a7a11fe0e0ca727be261e04e94
  • MD5 a9b14886ee101a248039aa9b60202afd
  • SHA1 74098a7145abad3665f049a9d396a8a0fb0a74f5
  • SHA512 f33d7031991b5311e5cc376a09dc4e8e815988515d51031a7f2fde6101e60cb4f5368dd5a797f6ee6d89ca8a5227724057135afd29475cc08a015e7b4ff623bc
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinediscoveryevasioninfostealerspywarestealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2