General
-
Target
7aae477e1b67f0ea2bcb3db61de5db9c2fb30469e622096c0f24f8d900587f84
-
Size
2.7MB
-
Sample
220215-n8tngaeef5
-
MD5
7c31273455d5df4d0b78f21eac4756d7
-
SHA1
0d28ed76a2b73717a8f88b47ef50dbffb33b1b73
-
SHA256
7aae477e1b67f0ea2bcb3db61de5db9c2fb30469e622096c0f24f8d900587f84
-
SHA512
f9d5610d79556e3a6f335a881eff7b511c209a77598f426f9d63dce71b55271a4ba59ca81a4d8fa2a3e7617011b2f39f363d3e6337a3cb92eeca3d0f762a0b43
Static task
static1
Behavioral task
behavioral1
Sample
7aae477e1b67f0ea2bcb3db61de5db9c2fb30469e622096c0f24f8d900587f84.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7aae477e1b67f0ea2bcb3db61de5db9c2fb30469e622096c0f24f8d900587f84.exe
Resource
win10v2004-en-20220112
Malware Config
Targets
-
-
Target
7aae477e1b67f0ea2bcb3db61de5db9c2fb30469e622096c0f24f8d900587f84
-
Size
2.7MB
-
MD5
7c31273455d5df4d0b78f21eac4756d7
-
SHA1
0d28ed76a2b73717a8f88b47ef50dbffb33b1b73
-
SHA256
7aae477e1b67f0ea2bcb3db61de5db9c2fb30469e622096c0f24f8d900587f84
-
SHA512
f9d5610d79556e3a6f335a881eff7b511c209a77598f426f9d63dce71b55271a4ba59ca81a4d8fa2a3e7617011b2f39f363d3e6337a3cb92eeca3d0f762a0b43
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-