General
-
Target
9fdb445364d1ac204d0f44516f7236fca009dd5d2dc089d388eeb2ec1e972c83
-
Size
2.8MB
-
Sample
220215-jgy2nadgcq
-
MD5
265ce3353bdf58373ba03e3481d9b320
-
SHA1
99f367e918eb55ac51421a140dc6f07c8fe84888
-
SHA256
9fdb445364d1ac204d0f44516f7236fca009dd5d2dc089d388eeb2ec1e972c83
-
SHA512
59244537faafce557e885e0f0157b1fb8197decec767d7f9c4c40a8586ccfbb3cd964768f6a4da12ba3976332e8954f826911ec2f0f4759d25d15eac84fda38a
Static task
static1
Behavioral task
behavioral1
Sample
9fdb445364d1ac204d0f44516f7236fca009dd5d2dc089d388eeb2ec1e972c83.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
9fdb445364d1ac204d0f44516f7236fca009dd5d2dc089d388eeb2ec1e972c83.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
9fdb445364d1ac204d0f44516f7236fca009dd5d2dc089d388eeb2ec1e972c83
-
Size
2.8MB
-
MD5
265ce3353bdf58373ba03e3481d9b320
-
SHA1
99f367e918eb55ac51421a140dc6f07c8fe84888
-
SHA256
9fdb445364d1ac204d0f44516f7236fca009dd5d2dc089d388eeb2ec1e972c83
-
SHA512
59244537faafce557e885e0f0157b1fb8197decec767d7f9c4c40a8586ccfbb3cd964768f6a4da12ba3976332e8954f826911ec2f0f4759d25d15eac84fda38a
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-