General
-
Target
8061a483fdf13f1c2245d68382fc29d919e8ac1f2e49672ebb4d22e5db35f9d6
-
Size
2.8MB
-
Sample
220215-n2b5vafger
-
MD5
16c0582a6818354d32270b29bc03437f
-
SHA1
24bd98187b6a900afd09dd1c60cdef2e9e7f9742
-
SHA256
8061a483fdf13f1c2245d68382fc29d919e8ac1f2e49672ebb4d22e5db35f9d6
-
SHA512
ccd9c363a0ee77370240e0b29954e593ede099c74e34893ff6e402fa97776e113a9d07274bd7f4c729a8ff51f56318036892f619d6ed6b4d85bf4b53eb7ba060
Static task
static1
Behavioral task
behavioral1
Sample
8061a483fdf13f1c2245d68382fc29d919e8ac1f2e49672ebb4d22e5db35f9d6.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8061a483fdf13f1c2245d68382fc29d919e8ac1f2e49672ebb4d22e5db35f9d6.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
8061a483fdf13f1c2245d68382fc29d919e8ac1f2e49672ebb4d22e5db35f9d6
-
Size
2.8MB
-
MD5
16c0582a6818354d32270b29bc03437f
-
SHA1
24bd98187b6a900afd09dd1c60cdef2e9e7f9742
-
SHA256
8061a483fdf13f1c2245d68382fc29d919e8ac1f2e49672ebb4d22e5db35f9d6
-
SHA512
ccd9c363a0ee77370240e0b29954e593ede099c74e34893ff6e402fa97776e113a9d07274bd7f4c729a8ff51f56318036892f619d6ed6b4d85bf4b53eb7ba060
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-