General
-
Target
9e3e68340103d0748a59ab2be72ec5a93e023235a67d79459c9aee5f2d08b397
-
Size
2.9MB
-
Sample
220215-jj264acdb9
-
MD5
30bbd3628e13d2017b0c9f30a5d15081
-
SHA1
01a710fb8b11116c98cb71b29ab86ca3317ba666
-
SHA256
9e3e68340103d0748a59ab2be72ec5a93e023235a67d79459c9aee5f2d08b397
-
SHA512
9e49ba02aa85bb94e84ef1380573fc0fb2b8b2a6aa59657e1fcc85162d4203c51118afe2bc3c147ab2d8bc466dafe0dc676b86d72e4bc5355df4bfc10dc785df
Static task
static1
Behavioral task
behavioral1
Sample
9e3e68340103d0748a59ab2be72ec5a93e023235a67d79459c9aee5f2d08b397.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
9e3e68340103d0748a59ab2be72ec5a93e023235a67d79459c9aee5f2d08b397.exe
Resource
win10v2004-en-20220112
Malware Config
Targets
-
-
Target
9e3e68340103d0748a59ab2be72ec5a93e023235a67d79459c9aee5f2d08b397
-
Size
2.9MB
-
MD5
30bbd3628e13d2017b0c9f30a5d15081
-
SHA1
01a710fb8b11116c98cb71b29ab86ca3317ba666
-
SHA256
9e3e68340103d0748a59ab2be72ec5a93e023235a67d79459c9aee5f2d08b397
-
SHA512
9e49ba02aa85bb94e84ef1380573fc0fb2b8b2a6aa59657e1fcc85162d4203c51118afe2bc3c147ab2d8bc466dafe0dc676b86d72e4bc5355df4bfc10dc785df
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-