General
-
Target
85f2c35da19cf828bb26a96e13780cdacfc24d08386f9a8fb0d29dd1decf542c
-
Size
3.3MB
-
Sample
220215-nvd1vsedb7
-
MD5
e76547e3e5f1ef9224631f883bf86a01
-
SHA1
1429f3f4e095c61e96b142cdf142dec69ea37754
-
SHA256
85f2c35da19cf828bb26a96e13780cdacfc24d08386f9a8fb0d29dd1decf542c
-
SHA512
2a9e9f9ff6dab49884416f999ddecdfbb440be83c4e7c2bb79730b63bc97416258f43426899fa314221866eaacf28ead09eff3cc06955ab04fd55466af9e4536
Static task
static1
Behavioral task
behavioral1
Sample
85f2c35da19cf828bb26a96e13780cdacfc24d08386f9a8fb0d29dd1decf542c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
85f2c35da19cf828bb26a96e13780cdacfc24d08386f9a8fb0d29dd1decf542c.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
85f2c35da19cf828bb26a96e13780cdacfc24d08386f9a8fb0d29dd1decf542c
-
Size
3.3MB
-
MD5
e76547e3e5f1ef9224631f883bf86a01
-
SHA1
1429f3f4e095c61e96b142cdf142dec69ea37754
-
SHA256
85f2c35da19cf828bb26a96e13780cdacfc24d08386f9a8fb0d29dd1decf542c
-
SHA512
2a9e9f9ff6dab49884416f999ddecdfbb440be83c4e7c2bb79730b63bc97416258f43426899fa314221866eaacf28ead09eff3cc06955ab04fd55466af9e4536
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-