General
-
Target
944788dc55e273f39ee26c7ee8b11193030188e4a78a79cdc560856e1817d7ad
-
Size
2.9MB
-
Sample
220215-jxhdvacef7
-
MD5
c8f92704cdeea742baffdd2850c6447f
-
SHA1
b38f8703fbb1f1051068136a65403a0e9d97c4c9
-
SHA256
944788dc55e273f39ee26c7ee8b11193030188e4a78a79cdc560856e1817d7ad
-
SHA512
ece09e94fb466eba0edadb65dba0eb711c52852e64da9f933f1c093bfe996c465a1f1c068792166ac826888ee1a23d8122ef450d9777753e7428cfe2b5fbec39
Static task
static1
Behavioral task
behavioral1
Sample
944788dc55e273f39ee26c7ee8b11193030188e4a78a79cdc560856e1817d7ad.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
944788dc55e273f39ee26c7ee8b11193030188e4a78a79cdc560856e1817d7ad.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
944788dc55e273f39ee26c7ee8b11193030188e4a78a79cdc560856e1817d7ad
-
Size
2.9MB
-
MD5
c8f92704cdeea742baffdd2850c6447f
-
SHA1
b38f8703fbb1f1051068136a65403a0e9d97c4c9
-
SHA256
944788dc55e273f39ee26c7ee8b11193030188e4a78a79cdc560856e1817d7ad
-
SHA512
ece09e94fb466eba0edadb65dba0eb711c52852e64da9f933f1c093bfe996c465a1f1c068792166ac826888ee1a23d8122ef450d9777753e7428cfe2b5fbec39
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-