Extracted

• • Target
    file.exe
  • Size 137KB
  • SHA256 9aecf1abe46d70a02d17800dbe3a8bda2f72f87456abb0dda69c7f7920cddb60
  • MD5 d8fa5ec2e689dfbc2559ef3a5cb69ca2
  • SHA1 c21dd2d112d69f52318dbef8bdeea892e09c7d19
  • SHA512 860d3ce9c0f0dc421773b09f54b47cc42faa0d8d702fb2fb901c0d191a6babde1b8d3eb339bb947c951574cd8ae3e3fb4d1bf5c1a8fa58323fea5f4ae7c163da
  • SSDEEP 3072:aYO/ZMTFjr+sIjLHydBupA8vWFjyRPkhCSSw6:aYMZMBjr3I/0BYBpkh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinealldiscoveryevasioninfostealerspywarestealerthemidatrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2