Overview

overview

10

Static

static

7

26a470850d...dd.exe

windows7_x64

10

26a470850d...dd.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26a470850db7daa36b8194cc87a6b4814ad548fbfe71a687c20eba0c458339dd

  • Size

    2.9MB

  • Sample

    220215-r8jp2shdbq

  • MD5

    afcbc5f069308a891dd7210cba20cb5c

  • SHA1

    c4bc9cd61e0d40e8d87a357649b9e9fdb6a55d3e

  • SHA256

    26a470850db7daa36b8194cc87a6b4814ad548fbfe71a687c20eba0c458339dd

  • SHA512

    0132a375856956a28f6d411552dd84b0af09608877181d6d3ee972ac8ce1306cba9764520da94ad76188cc0b108562c3756a415ca38e3eafd1b37ccd03999f40

Score
10/10
redlineevasioninfostealerthemidatrojan

Malware Config

Targets

    • Target

      26a470850db7daa36b8194cc87a6b4814ad548fbfe71a687c20eba0c458339dd

    • Size

      2.9MB

    • MD5

      afcbc5f069308a891dd7210cba20cb5c

    • SHA1

      c4bc9cd61e0d40e8d87a357649b9e9fdb6a55d3e

    • SHA256

      26a470850db7daa36b8194cc87a6b4814ad548fbfe71a687c20eba0c458339dd

    • SHA512

      0132a375856956a28f6d411552dd84b0af09608877181d6d3ee972ac8ce1306cba9764520da94ad76188cc0b108562c3756a415ca38e3eafd1b37ccd03999f40

    Score
    10/10
    redlineevasioninfostealerthemidatrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks