Extracted

• • Target
    SecuriteInfo.com.Win32.CrypterX-gen.18764.12891.exe
  • Size 2.6MB
  • SHA256 41d1e68ca8ce71c9900d8e02c93a9e23a1f7ae02aec9b3b61b39fc410262fdad
  • MD5 aa1340e6de19d9206466a3e46505637a
  • SHA1 cf2c701eaa0b3d4bb9ee758fe0070a5fdea4f199
  • SHA512 d63ba471591e20cd9d8cd3467ecb7979f262444550288d07b2027ab67fb9147848ce60098a2cd0606e5ba01315e8339abd2a9ebbd014fc446822b3b184f10e90
  • SSDEEP 49152:q/pHoS8FLhcMV6jkf/y2GnS69qGCBArQaF1ClrLG6/ShIssmz1JvXsB:q/xYFLODi/yhS6MHMQaGNLL/C7smplX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redline7evasioninfostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2