redline | b704a93a48716895f924221cc63e3bec2f9681b92cfe4b9176f1cf98ce77ce74 | Triage

Submit
Reports

Overview

overview

Static

static

7

b704a93a48...74.exe

windows7_x64

b704a93a48...74.exe

windows10-2004_x64

Sharing

General

Target

b704a93a48716895f924221cc63e3bec2f9681b92cfe4b9176f1cf98ce77ce74
Size

2.8MB
Sample

220215-hk3zcaddak
MD5

934a2ff0a3b70b560122a52f67eb50bf
SHA1

15747565aea9329806fe74ffe1b9f70685edea9b
SHA256

b704a93a48716895f924221cc63e3bec2f9681b92cfe4b9176f1cf98ce77ce74
SHA512

0abb3bcfe8962d7bec40fe507908909ffe57e6b49bf0e6a098cc4574ba2b979f8894c8016ef276ce250aaf723f1c4a910e44fe9b4868af66b3cadd2a989b3428

Score

10^/10

redline evasion infostealer themida trojan

Static task

static1

Behavioral task

behavioral1

Sample

b704a93a48716895f924221cc63e3bec2f9681b92cfe4b9176f1cf98ce77ce74.exe

Resource

win7-en-20211208

redline evasion infostealer themida trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

b704a93a48716895f924221cc63e3bec2f9681b92cfe4b9176f1cf98ce77ce74.exe

Resource

win10v2004-en-20220112

redline evasion infostealer themida trojan

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Targets

- Target
  
  b704a93a48716895f924221cc63e3bec2f9681b92cfe4b9176f1cf98ce77ce74
- Size
  
  2.8MB
- MD5
  
  934a2ff0a3b70b560122a52f67eb50bf
- SHA1
  
  15747565aea9329806fe74ffe1b9f70685edea9b
- SHA256
  
  b704a93a48716895f924221cc63e3bec2f9681b92cfe4b9176f1cf98ce77ce74
- SHA512
  
  0abb3bcfe8962d7bec40fe507908909ffe57e6b49bf0e6a098cc4574ba2b979f8894c8016ef276ce250aaf723f1c4a910e44fe9b4868af66b3cadd2a989b3428
Score

10^/10

redline evasion infostealer themida trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

redlineevasioninfostealerthemidatrojan

behavioral2

redlineevasioninfostealerthemidatrojan

© 2018-2024

Terms | Privacy