General
-
Target
78c9af7187daecedd0a414ea6e16b49f07ea69c0bd012389ae36041b016595d1
-
Size
2.8MB
-
Sample
220215-payp7sfhfp
-
MD5
30d45a8640606cf64f66f97017e112cc
-
SHA1
6f75a8cb5a39810b45402713d65d8736f237fc1a
-
SHA256
78c9af7187daecedd0a414ea6e16b49f07ea69c0bd012389ae36041b016595d1
-
SHA512
5bd7de27e20b5e74ea2d7ef5c67eca266338a3b528017f1d48e7cb4b9eb65871e4081bcba92f188679a53cb718949d19d591e19720b6b752e9498e982067582f
Static task
static1
Behavioral task
behavioral1
Sample
78c9af7187daecedd0a414ea6e16b49f07ea69c0bd012389ae36041b016595d1.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
78c9af7187daecedd0a414ea6e16b49f07ea69c0bd012389ae36041b016595d1.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
78c9af7187daecedd0a414ea6e16b49f07ea69c0bd012389ae36041b016595d1
-
Size
2.8MB
-
MD5
30d45a8640606cf64f66f97017e112cc
-
SHA1
6f75a8cb5a39810b45402713d65d8736f237fc1a
-
SHA256
78c9af7187daecedd0a414ea6e16b49f07ea69c0bd012389ae36041b016595d1
-
SHA512
5bd7de27e20b5e74ea2d7ef5c67eca266338a3b528017f1d48e7cb4b9eb65871e4081bcba92f188679a53cb718949d19d591e19720b6b752e9498e982067582f
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-