Extracted

• • Target

    Active Stealers.zip

  • Size

    2.0MB

  • MD5

    b2ada3da073edb78931a84122a4fe833

  • SHA1

    ad4654d77fbab44f887b1346f1bcdc48348bff00

  • SHA256

    36b4988cc1d292a25b5f223b928cbb312a313895c61e4c5a6d53c133382d629f

  • SHA512

    4189d09be7bd85d1931744ac4c3b48e9e446cfc7247d036791fb653291b998edc1d9f180953ad7e344d189960b39b8c7ddc7234ece11b6f976e780b47a46423d

  • SSDEEP

    49152:8czCGEcqjUZ2jIYqLJ6yEu+hPyZZYh4xQjpVQlhI37XQLyuoRf:+UwjtqLNEu+hPeZYh4DvdAf

  Score

  10^/10

  redline@cuteblanevasioninfostealerspywarethemida

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1