Extracted

• • Target
    2a1fdac565b24b16cb78c4737ba95c4b.exe
  • Size 2.6MB
  • SHA256 f8a941938484a00306232e77b8af41e7f81df56e4aa9864a2b59ea8ebfbc892b
  • MD5 2a1fdac565b24b16cb78c4737ba95c4b
  • SHA1 32d07629df648f8e6807a95a6ede74bce0b4b554
  • SHA512 b59b41189a74424d1bda69e368079fa25294a92a79d3893a056cee2942aa79d82dc33456bd046e52e71f3ee13d6f3ba491dc272bbdc52efbcecb78d5d76d851d
  • SSDEEP 24576:CR3EuWHEEr91KZYKYm+zhUvfMDSdMgnJK1V78O6lCXLL1olGl3RuQ55313F:CSuA314dYqO6lCXLGAl3/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlineevasioninfostealerspywarethemidatrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2