Extracted

• • Target
    download
  • Size 2KB
  • SHA256 b3ab92edbf5f695b8de6a6dc7215b81355071d5919e81e482701e102ca904374
  • MD5 4e79e21cb97b8518a239e31cf0d11fa3
  • SHA1 2dff54cdc32d26278d9fe2919ed8bf3566092749
  • SHA512 94d6729a958c7967ca059a9d6b31d1522e372fc623b4aab4114429b733c0686af306a7166bf02681f8be9ec4b01ccf5d5d17d18e5ca0f087d4fc62889bb4830d
  • MD5 SHA1 SHA512

  Score

  10^/10

  redline1evasioninfostealerpersistencespywaretrojanupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2