Overview

overview

10

Static

static

7

7c29083840...ca.exe

windows7_x64

10

7c29083840...ca.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c290838403800a0ab463efa43ed7ba9c38b7ece1aa68ddd125a26eefedf5fca

  • Size

    4.1MB

  • Sample

    220708-shzt1sfbfl

  • MD5

    956be8fd2f1c87c406c84ded0b45ce72

  • SHA1

    5ae5d185585756f99448bd0f3410abd7a59bf557

  • SHA256

    7c290838403800a0ab463efa43ed7ba9c38b7ece1aa68ddd125a26eefedf5fca

  • SHA512

    e79f770e27f7638b4c7d27c6489f43a4af21b1b3ed6a8c71158e00cfd98f4f3cc7991ee464e8fac0a523e76dad243351e6ce4017eaf8f1fb6f862921a975c09a

Score
10/10
redline01012021evasioninfostealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

01012021

C2

95.217.250.25:3074

Targets

    • Target

      7c290838403800a0ab463efa43ed7ba9c38b7ece1aa68ddd125a26eefedf5fca

    • Size

      4.1MB

    • MD5

      956be8fd2f1c87c406c84ded0b45ce72

    • SHA1

      5ae5d185585756f99448bd0f3410abd7a59bf557

    • SHA256

      7c290838403800a0ab463efa43ed7ba9c38b7ece1aa68ddd125a26eefedf5fca

    • SHA512

      e79f770e27f7638b4c7d27c6489f43a4af21b1b3ed6a8c71158e00cfd98f4f3cc7991ee464e8fac0a523e76dad243351e6ce4017eaf8f1fb6f862921a975c09a

    Score
    10/10
    redline01012021evasioninfostealerthemidatrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks