redline

General

Target

c9a7a2c5c72405bd331e9087ec23a14e744c52fe47e13e38a251c35092cdbd54
Size

5.9MB
Sample

220215-gwv77sdacr
MD5

9a16a4046cc7bdd869231f836438e76b
SHA1

46e1633c6598b9297b2ec46f740d6da114c31a56
SHA256

c9a7a2c5c72405bd331e9087ec23a14e744c52fe47e13e38a251c35092cdbd54
SHA512

e682ceae529f3c86ffb3427f877f2abd2b6446daadd7469a16fc0be7f08a45845680589a55d2bd0c6fadb80ecff08155a8dfe5fc50b47396c475e587488b8317

Score

10^/10

Malware Config

Targets

- Target
  
  c9a7a2c5c72405bd331e9087ec23a14e744c52fe47e13e38a251c35092cdbd54
- Size
  
  5.9MB
- MD5
  
  9a16a4046cc7bdd869231f836438e76b
- SHA1
  
  46e1633c6598b9297b2ec46f740d6da114c31a56
- SHA256
  
  c9a7a2c5c72405bd331e9087ec23a14e744c52fe47e13e38a251c35092cdbd54
- SHA512
  
  e682ceae529f3c86ffb3427f877f2abd2b6446daadd7469a16fc0be7f08a45845680589a55d2bd0c6fadb80ecff08155a8dfe5fc50b47396c475e587488b8317
Score

10^/10

redline evasion infostealer themida trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

5

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

RedLine Payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Executes dropped EXE

Checks BIOS information in registry

Checks computer location settings

Loads dropped DLL

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2