General
-
Target
a08b73c159c3924f60a78fe21029cae84ee88e289a7ff6bdf27869399cc88382
-
Size
2.9MB
-
Sample
220215-jfwj5sdgbr
-
MD5
c561708b03a328fa892fe6151f81c2dd
-
SHA1
02f445cab7c389c324d31b621ff7f56772317cd6
-
SHA256
a08b73c159c3924f60a78fe21029cae84ee88e289a7ff6bdf27869399cc88382
-
SHA512
2e7143f8aab899a8267f910345feed02d0604fd3d0b56d42b797eb5ac3f67bf23856efe43167fd0b33ea3d5c9a4d1b646e9ffa3dc3c6695ae7e2d1f2b7196a54
Static task
static1
Behavioral task
behavioral1
Sample
a08b73c159c3924f60a78fe21029cae84ee88e289a7ff6bdf27869399cc88382.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a08b73c159c3924f60a78fe21029cae84ee88e289a7ff6bdf27869399cc88382.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
a08b73c159c3924f60a78fe21029cae84ee88e289a7ff6bdf27869399cc88382
-
Size
2.9MB
-
MD5
c561708b03a328fa892fe6151f81c2dd
-
SHA1
02f445cab7c389c324d31b621ff7f56772317cd6
-
SHA256
a08b73c159c3924f60a78fe21029cae84ee88e289a7ff6bdf27869399cc88382
-
SHA512
2e7143f8aab899a8267f910345feed02d0604fd3d0b56d42b797eb5ac3f67bf23856efe43167fd0b33ea3d5c9a4d1b646e9ffa3dc3c6695ae7e2d1f2b7196a54
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-