Overview

overview

10

Static

static

7

4b7b9c0cd9...14.exe

windows7_x64

10

4b7b9c0cd9...14.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b7b9c0cd9f72c551d60e29f34b2f9d98274866c2118d228b7919e2aad71c714

  • Size

    3.1MB

  • Sample

    220215-qxq5baggcp

  • MD5

    45df874c8aa701dfc44c8a34b6737dcb

  • SHA1

    b70957a4998ed699e3417f49478c6f185b2dc5b7

  • SHA256

    4b7b9c0cd9f72c551d60e29f34b2f9d98274866c2118d228b7919e2aad71c714

  • SHA512

    469e4c4a943895c1484be13f258db9599af9c4703f9310bcb5f96eeff054460b11fca0f296d8910e93c2fb5839ee10903fa6a76a887893767de4d6328cfd9efb

Score
10/10
redlineevasioninfostealerthemidatrojan

Malware Config

Targets

    • Target

      4b7b9c0cd9f72c551d60e29f34b2f9d98274866c2118d228b7919e2aad71c714

    • Size

      3.1MB

    • MD5

      45df874c8aa701dfc44c8a34b6737dcb

    • SHA1

      b70957a4998ed699e3417f49478c6f185b2dc5b7

    • SHA256

      4b7b9c0cd9f72c551d60e29f34b2f9d98274866c2118d228b7919e2aad71c714

    • SHA512

      469e4c4a943895c1484be13f258db9599af9c4703f9310bcb5f96eeff054460b11fca0f296d8910e93c2fb5839ee10903fa6a76a887893767de4d6328cfd9efb

    Score
    10/10
    redlineevasioninfostealerthemidatrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks