Extracted

• • Target

    Setup.exe

  • Size

    5.0MB

  • MD5

    36ec5db7a7da85a85416870098529108

  • SHA1

    5f2052d19badb1a953fb53aae197d7126106beb6

  • SHA256

    b86b793d720b43d3fb1525f98758256d1ccf4ed543dc1bd01b54921f7143fb46

  • SHA512

    00e544be80e53281a6e66c473a8d8c436003fe76f1b464515ba5f50b523c40acc302ba3d348d1cbbd2970611127fd336e84de9a3f55ab85e46ceb512ed5c7b9b

  • SSDEEP

    49152:SZWMqic3obV0//WmD1ufCiORefaMG2wyFK7O3c194MXxdhtF4My9KMlenxepLMz:JMNRb6HdjSZZFKy7MhPOg

  Score

  10^/10

  redlinetest 21.04.2023evasioninfostealerthemidatrojanspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2