Overview

overview

10

Static

static

7

e3c39d392a...a8.exe

windows7_x64

10

e3c39d392a...a8.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e3c39d392a9f3beb21dbf5f1ddcbebe8feb4821329ac51e4dbe9806852ff92a8

  • Size

    2.4MB

  • Sample

    220215-fzg93sbbf7

  • MD5

    8b412d4f52aace155bc4c50256d1378e

  • SHA1

    7f411dedb607b4e16651e70c4c656e1e0e1d490e

  • SHA256

    e3c39d392a9f3beb21dbf5f1ddcbebe8feb4821329ac51e4dbe9806852ff92a8

  • SHA512

    5316057996b2150f25775c7020b5dd19623354113cc56119673695142df90bf31a8ae77a7e66ef7671e8c8563db440627752f19045d6a47ae1c82a65ed132638

Score
10/10
redlineevasioninfostealerthemidatrojan

Malware Config

Targets

    • Target

      e3c39d392a9f3beb21dbf5f1ddcbebe8feb4821329ac51e4dbe9806852ff92a8

    • Size

      2.4MB

    • MD5

      8b412d4f52aace155bc4c50256d1378e

    • SHA1

      7f411dedb607b4e16651e70c4c656e1e0e1d490e

    • SHA256

      e3c39d392a9f3beb21dbf5f1ddcbebe8feb4821329ac51e4dbe9806852ff92a8

    • SHA512

      5316057996b2150f25775c7020b5dd19623354113cc56119673695142df90bf31a8ae77a7e66ef7671e8c8563db440627752f19045d6a47ae1c82a65ed132638

    Score
    10/10
    redlineevasioninfostealerthemidatrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks