General
-
Target
842747a1f0e277fcb3018c69425e666e3124ded094dbf492b9c19008fbfd37af
-
Size
2.7MB
-
Sample
220215-nxk7ysedd7
-
MD5
a1fbef6bdf66dc84739ff4775c81a915
-
SHA1
8b711a4a22c7afcc6140e63ce63a779d6ac4af49
-
SHA256
842747a1f0e277fcb3018c69425e666e3124ded094dbf492b9c19008fbfd37af
-
SHA512
e6b072e3f93331311cb61152ff0bbe819b63353c2dab2ee045d3d3d745be639a3161463fc7b5e38c5df20bd5daa34e6deaf2ea3dc65a264599fab705bcb3cf64
Static task
static1
Behavioral task
behavioral1
Sample
842747a1f0e277fcb3018c69425e666e3124ded094dbf492b9c19008fbfd37af.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
842747a1f0e277fcb3018c69425e666e3124ded094dbf492b9c19008fbfd37af.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
842747a1f0e277fcb3018c69425e666e3124ded094dbf492b9c19008fbfd37af
-
Size
2.7MB
-
MD5
a1fbef6bdf66dc84739ff4775c81a915
-
SHA1
8b711a4a22c7afcc6140e63ce63a779d6ac4af49
-
SHA256
842747a1f0e277fcb3018c69425e666e3124ded094dbf492b9c19008fbfd37af
-
SHA512
e6b072e3f93331311cb61152ff0bbe819b63353c2dab2ee045d3d3d745be639a3161463fc7b5e38c5df20bd5daa34e6deaf2ea3dc65a264599fab705bcb3cf64
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-