General
-
Target
49ec761dd9f05eaac28aa93ec47034f754364726542b9de7cee5d6592bf0c4ec
-
Size
2.6MB
-
Sample
220215-qzt9raggeq
-
MD5
8fbf01af64c7bb1289a26b1f7574ae9e
-
SHA1
bcb617c6977334e789f9eace561f1c931024b32c
-
SHA256
49ec761dd9f05eaac28aa93ec47034f754364726542b9de7cee5d6592bf0c4ec
-
SHA512
0cdac73d08652435e48ea05dd73cc414a212c40dcc62b96c637a2a2cd35e24aafecdc99f1c9f023089bf16c6a9dc3b87dae5d38ffa58878820ec32c1cd1fbe62
Static task
static1
Behavioral task
behavioral1
Sample
49ec761dd9f05eaac28aa93ec47034f754364726542b9de7cee5d6592bf0c4ec.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
49ec761dd9f05eaac28aa93ec47034f754364726542b9de7cee5d6592bf0c4ec.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
49ec761dd9f05eaac28aa93ec47034f754364726542b9de7cee5d6592bf0c4ec
-
Size
2.6MB
-
MD5
8fbf01af64c7bb1289a26b1f7574ae9e
-
SHA1
bcb617c6977334e789f9eace561f1c931024b32c
-
SHA256
49ec761dd9f05eaac28aa93ec47034f754364726542b9de7cee5d6592bf0c4ec
-
SHA512
0cdac73d08652435e48ea05dd73cc414a212c40dcc62b96c637a2a2cd35e24aafecdc99f1c9f023089bf16c6a9dc3b87dae5d38ffa58878820ec32c1cd1fbe62
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-