Extracted

• • Target

    file.exe

  • Size

    1.9MB

  • MD5

    4f2d4b2e1de4a5b2bf4570bc4fdb5d99

  • SHA1

    80f993d5483c75e654db701b846a18b19384d2c4

  • SHA256

    2a551466afe3b8ee2c53c1c55edee43ed789ce59c296b90a9db6682b16971758

  • SHA512

    c90256f474d5615b3f9fde7c87b8c97fe31ad8282f862e6ffc18c3b0dadc85747b4f37dd7a60ca14f6d24a14c271985e83688b7cfd955739ec733e5b9c22abd4

  • SSDEEP

    12288:ZrhFxXfu3LO7VzpavNcfu+wGHd3f+QcFKeEHokyu5ag9X6a9DhvhN6TsBeMrvZtw:nfu3LaVzpavNcbtd31UW6a9Dhvh2WvV

  Score

  10^/10

  redline@black_santa21evasioninfostealerspywarethemidatrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2