General
-
Target
8ef9d91092116117714033f25ca136675794e2e4a34d50ec5f3b7016fb7600d3
-
Size
2.8MB
-
Sample
220215-j38szscfe4
-
MD5
99a9e989639c1beb67f452a70a3ebef4
-
SHA1
a8b86ed82867c5b4d38e4bb419d614af65803eb4
-
SHA256
8ef9d91092116117714033f25ca136675794e2e4a34d50ec5f3b7016fb7600d3
-
SHA512
324bfca66d04ba8c5af8dd6bb405efe15148c7567036de9beb384c9a7460b317ac4d7b3fe2483f00e6df198985c5ec44e5981fefc689aadbc4da0fa017dfd133
Static task
static1
Behavioral task
behavioral1
Sample
8ef9d91092116117714033f25ca136675794e2e4a34d50ec5f3b7016fb7600d3.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8ef9d91092116117714033f25ca136675794e2e4a34d50ec5f3b7016fb7600d3.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
8ef9d91092116117714033f25ca136675794e2e4a34d50ec5f3b7016fb7600d3
-
Size
2.8MB
-
MD5
99a9e989639c1beb67f452a70a3ebef4
-
SHA1
a8b86ed82867c5b4d38e4bb419d614af65803eb4
-
SHA256
8ef9d91092116117714033f25ca136675794e2e4a34d50ec5f3b7016fb7600d3
-
SHA512
324bfca66d04ba8c5af8dd6bb405efe15148c7567036de9beb384c9a7460b317ac4d7b3fe2483f00e6df198985c5ec44e5981fefc689aadbc4da0fa017dfd133
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-