Overview

overview

10

Static

static

7

473b161ab7...b7.exe

windows7_x64

10

473b161ab7...b7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    473b161ab7fd8802a33d016898f513b190f4e238fcf652755900a182a44a28b7

  • Size

    5.4MB

  • Sample

    220714-h6v6macbam

  • MD5

    e3d6dc87f0151a02413405cf24679168

  • SHA1

    536c88ef259f430f9982159344878c714408aab0

  • SHA256

    473b161ab7fd8802a33d016898f513b190f4e238fcf652755900a182a44a28b7

  • SHA512

    82d3dadcc267e0f5f9f31ade49084cc7b56ffc80861d7b124cb6e2e4ec64eceff7d6b02dd6117a342e3bff5045e66a38cae4a940ce6f3c7c6ee4cd90bb81f855

Score
10/10
redline@whizzkid1evasioninfostealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

@whizzkid1

C2

185.215.113.83:60722

Attributes
  • auth_value

    ff9f6167737e6e2ab682ab9de72ded7d

Targets

    • Target

      473b161ab7fd8802a33d016898f513b190f4e238fcf652755900a182a44a28b7

    • Size

      5.4MB

    • MD5

      e3d6dc87f0151a02413405cf24679168

    • SHA1

      536c88ef259f430f9982159344878c714408aab0

    • SHA256

      473b161ab7fd8802a33d016898f513b190f4e238fcf652755900a182a44a28b7

    • SHA512

      82d3dadcc267e0f5f9f31ade49084cc7b56ffc80861d7b124cb6e2e4ec64eceff7d6b02dd6117a342e3bff5045e66a38cae4a940ce6f3c7c6ee4cd90bb81f855

    Score
    10/10
    redline@whizzkid1evasioninfostealerthemidatrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks