General
-
Target
62f1b49885ebb55d27ee6340b0785c60b070ce08de63421508b6563c1c0b78db
-
Size
2.7MB
-
Sample
220215-p4dl5afac8
-
MD5
95163b66b4a23c5bd705624d5096bdd2
-
SHA1
db0674f6bb95da2d3aace67b7eb2d035851d7e55
-
SHA256
62f1b49885ebb55d27ee6340b0785c60b070ce08de63421508b6563c1c0b78db
-
SHA512
e81bfc6633774c8774775697dbf926a2b4113c093a7befe5e0cdc43a808c66cc2e6d6d39fc53d4b5ee1fd89f9adbf8fc139e915816e8dbdec2849bf5f241dfac
Static task
static1
Behavioral task
behavioral1
Sample
62f1b49885ebb55d27ee6340b0785c60b070ce08de63421508b6563c1c0b78db.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
62f1b49885ebb55d27ee6340b0785c60b070ce08de63421508b6563c1c0b78db.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
62f1b49885ebb55d27ee6340b0785c60b070ce08de63421508b6563c1c0b78db
-
Size
2.7MB
-
MD5
95163b66b4a23c5bd705624d5096bdd2
-
SHA1
db0674f6bb95da2d3aace67b7eb2d035851d7e55
-
SHA256
62f1b49885ebb55d27ee6340b0785c60b070ce08de63421508b6563c1c0b78db
-
SHA512
e81bfc6633774c8774775697dbf926a2b4113c093a7befe5e0cdc43a808c66cc2e6d6d39fc53d4b5ee1fd89f9adbf8fc139e915816e8dbdec2849bf5f241dfac
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-