Extracted

• • Target

    90be6ac311a6ba3a3cf50f3fb4c39d67ead054ef3b23ff98866faba74e6fc61c

  • Size

    5.1MB

  • MD5

    2a546fbb6001f5824e78096255282da9

  • SHA1

    5193501158de8a32bc0d91915e6f9a2af9f342ab

  • SHA256

    90be6ac311a6ba3a3cf50f3fb4c39d67ead054ef3b23ff98866faba74e6fc61c

  • SHA512

    da40f932a4a64d24feba65011e7b90a4a4c7b80069613564e6f89a17f216d0eced1805c99471ff2ba8d8d16355516a02afb001710485e0c09a06a999f67aa25a

  Score

  10^/10

  redline@sc4lly1337evasioninfostealerthemidatrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2