General
-
Target
686e774a9af6f1063345950940e89a3f5b3deaada7fb7e82f3020b9184ab0a25
-
Size
3.5MB
-
Sample
220215-pvgbnagbhm
-
MD5
78e83f976985faa13a6f4ffb4ce98e8b
-
SHA1
a6e0e38948437ea5d9c11414f57f6b73c8bff94e
-
SHA256
686e774a9af6f1063345950940e89a3f5b3deaada7fb7e82f3020b9184ab0a25
-
SHA512
68fce43f98ded3c9fcf909944d64e5abbe69917d0134717a2e31f78fe918fddc281c86bb47c0bac0b98a42297e9d844683a90ce093c651d9d0a31b7c6e0a680b
Static task
static1
Behavioral task
behavioral1
Sample
686e774a9af6f1063345950940e89a3f5b3deaada7fb7e82f3020b9184ab0a25.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
686e774a9af6f1063345950940e89a3f5b3deaada7fb7e82f3020b9184ab0a25.exe
Resource
win10v2004-en-20220112
Malware Config
Targets
-
-
Target
686e774a9af6f1063345950940e89a3f5b3deaada7fb7e82f3020b9184ab0a25
-
Size
3.5MB
-
MD5
78e83f976985faa13a6f4ffb4ce98e8b
-
SHA1
a6e0e38948437ea5d9c11414f57f6b73c8bff94e
-
SHA256
686e774a9af6f1063345950940e89a3f5b3deaada7fb7e82f3020b9184ab0a25
-
SHA512
68fce43f98ded3c9fcf909944d64e5abbe69917d0134717a2e31f78fe918fddc281c86bb47c0bac0b98a42297e9d844683a90ce093c651d9d0a31b7c6e0a680b
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-