General
-
Target
a4c03f5f258cf063a9bac6b62c8db575abfbd06ffe264bc3a62c01e0c511b765
-
Size
2.7MB
-
Sample
220215-jasw3accc8
-
MD5
1f741f13cae5d0c5ec4fab8af6260469
-
SHA1
40b31ccc9925f731dce9d056c3b18c933c3ec3ce
-
SHA256
a4c03f5f258cf063a9bac6b62c8db575abfbd06ffe264bc3a62c01e0c511b765
-
SHA512
a4d04939e1c8f059cf4a6c5c0e10368971afde0ef9f66e9aa2deedecb44e859c2e60888a1d9fb8788d92a256eeb100e24e8a310053eb10334e27cc31093cff30
Static task
static1
Behavioral task
behavioral1
Sample
a4c03f5f258cf063a9bac6b62c8db575abfbd06ffe264bc3a62c01e0c511b765.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a4c03f5f258cf063a9bac6b62c8db575abfbd06ffe264bc3a62c01e0c511b765.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
a4c03f5f258cf063a9bac6b62c8db575abfbd06ffe264bc3a62c01e0c511b765
-
Size
2.7MB
-
MD5
1f741f13cae5d0c5ec4fab8af6260469
-
SHA1
40b31ccc9925f731dce9d056c3b18c933c3ec3ce
-
SHA256
a4c03f5f258cf063a9bac6b62c8db575abfbd06ffe264bc3a62c01e0c511b765
-
SHA512
a4d04939e1c8f059cf4a6c5c0e10368971afde0ef9f66e9aa2deedecb44e859c2e60888a1d9fb8788d92a256eeb100e24e8a310053eb10334e27cc31093cff30
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-