General
-
Target
7613ec5bb6665d718ef4c035ec781bdb27df736c4aca0f418dff8a2f6164fa16
-
Size
3.5MB
-
Sample
220215-pez4tsgacj
-
MD5
347d8e2d19eef7fef12b7a74ff3fbec1
-
SHA1
e166c493d6435819356615bcbef8d18438fcc047
-
SHA256
7613ec5bb6665d718ef4c035ec781bdb27df736c4aca0f418dff8a2f6164fa16
-
SHA512
06903266eb8cf9cc175ea2ca1a5361b517fef9a93a8eeb8ad9291bc721c977e6219b793919e0f23defc84179998ffa05965cb2c20423367013f37fa0d9e4e2dd
Static task
static1
Behavioral task
behavioral1
Sample
7613ec5bb6665d718ef4c035ec781bdb27df736c4aca0f418dff8a2f6164fa16.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7613ec5bb6665d718ef4c035ec781bdb27df736c4aca0f418dff8a2f6164fa16.exe
Resource
win10v2004-en-20220112
Malware Config
Targets
-
-
Target
7613ec5bb6665d718ef4c035ec781bdb27df736c4aca0f418dff8a2f6164fa16
-
Size
3.5MB
-
MD5
347d8e2d19eef7fef12b7a74ff3fbec1
-
SHA1
e166c493d6435819356615bcbef8d18438fcc047
-
SHA256
7613ec5bb6665d718ef4c035ec781bdb27df736c4aca0f418dff8a2f6164fa16
-
SHA512
06903266eb8cf9cc175ea2ca1a5361b517fef9a93a8eeb8ad9291bc721c977e6219b793919e0f23defc84179998ffa05965cb2c20423367013f37fa0d9e4e2dd
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-