redline

General

Target

file
Size

312KB
Sample

240801-njajasselg
MD5

eac54c77a132de1321de2b7c014512a9
SHA1

58e2f16d2ddb9dbd5908f291de2665fa8bc1e7f6
SHA256

a83fea4d354875936b6239b40ada368af6f69596d78f94e30dbd786921bac719
SHA512

e89e8f2588c377762430f563234112be0ea00495ec0878e90f11bf699e2738fa52b8a040289611e60afb2f2624f025b4f92fe6ae4712011c892d2ae802b22e20
SSDEEP

3072:qi7gAkHnjPIQ6KSEc/rHzPaW+LN7DxRLlzglKSVO7k:FgAkHnjPIQBSECTPCN7jBSVO7k

Score

10^/10

Malware Config

Targets

- Target
  
  file
- Size
  
  312KB
- MD5
  
  eac54c77a132de1321de2b7c014512a9
- SHA1
  
  58e2f16d2ddb9dbd5908f291de2665fa8bc1e7f6
- SHA256
  
  a83fea4d354875936b6239b40ada368af6f69596d78f94e30dbd786921bac719
- SHA512
  
  e89e8f2588c377762430f563234112be0ea00495ec0878e90f11bf699e2738fa52b8a040289611e60afb2f2624f025b4f92fe6ae4712011c892d2ae802b22e20
- SSDEEP
  
  3072:qi7gAkHnjPIQ6KSEc/rHzPaW+LN7DxRLlzglKSVO7k:FgAkHnjPIQBSECTPCN7jBSVO7k
Score

10^/10

redline sectoprat credential_access discovery evasion infostealer rat spyware stealer themida trojan upx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1