Overview

overview

10

Static

static

7

c34b5f769b...05.exe

windows7_x64

10

c34b5f769b...05.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c34b5f769bccb3858f0783c7922126aaf856d27bad2142f374667b59aacd3c05

  • Size

    2.8MB

  • Sample

    220215-g5dphsbfh8

  • MD5

    c085b83000843d22b8cd05bbc7b159c6

  • SHA1

    afe10482ad5182c87cf69524f8ef4cb2b95a2fef

  • SHA256

    c34b5f769bccb3858f0783c7922126aaf856d27bad2142f374667b59aacd3c05

  • SHA512

    7bd5e675f6ae902e5391f38fe1739dc6e838bfa4fa8832dedf3de1432203780c0e1395d72bfd5bdc47e219e7f75a02c771b4ba003711ca2d0b03e3ee11f010d5

Score
10/10
redlineevasioninfostealerthemidatrojan

Malware Config

Targets

    • Target

      c34b5f769bccb3858f0783c7922126aaf856d27bad2142f374667b59aacd3c05

    • Size

      2.8MB

    • MD5

      c085b83000843d22b8cd05bbc7b159c6

    • SHA1

      afe10482ad5182c87cf69524f8ef4cb2b95a2fef

    • SHA256

      c34b5f769bccb3858f0783c7922126aaf856d27bad2142f374667b59aacd3c05

    • SHA512

      7bd5e675f6ae902e5391f38fe1739dc6e838bfa4fa8832dedf3de1432203780c0e1395d72bfd5bdc47e219e7f75a02c771b4ba003711ca2d0b03e3ee11f010d5

    Score
    10/10
    redlineevasioninfostealerthemidatrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks