General
-
Target
7a9684f0e6059132d9d31d73e1ed3a5b36cfd50c27a73866afc17977708fa8ed
-
Size
3.0MB
-
Sample
220215-n82n3sfhej
-
MD5
c0786eaf915a205bb066e598e5418c6b
-
SHA1
8440f9408fa74c88fad34977ca1ac639c1f5ef2e
-
SHA256
7a9684f0e6059132d9d31d73e1ed3a5b36cfd50c27a73866afc17977708fa8ed
-
SHA512
4ecad942db3dc06da1c6c158e850eb7460bd4e3ba51e6abb304fec81cbd27aff475e9e3df37043de0dbc4f757b03a1588eb13c560a687c8d039a41bc6667c2c4
Static task
static1
Behavioral task
behavioral1
Sample
7a9684f0e6059132d9d31d73e1ed3a5b36cfd50c27a73866afc17977708fa8ed.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7a9684f0e6059132d9d31d73e1ed3a5b36cfd50c27a73866afc17977708fa8ed.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
fickerstealer
game2030.site:80
Targets
-
-
Target
7a9684f0e6059132d9d31d73e1ed3a5b36cfd50c27a73866afc17977708fa8ed
-
Size
3.0MB
-
MD5
c0786eaf915a205bb066e598e5418c6b
-
SHA1
8440f9408fa74c88fad34977ca1ac639c1f5ef2e
-
SHA256
7a9684f0e6059132d9d31d73e1ed3a5b36cfd50c27a73866afc17977708fa8ed
-
SHA512
4ecad942db3dc06da1c6c158e850eb7460bd4e3ba51e6abb304fec81cbd27aff475e9e3df37043de0dbc4f757b03a1588eb13c560a687c8d039a41bc6667c2c4
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-