redline

General

Target

1a1a61ea96f734f572ce0836182585ea0533c87c50a68dccb43d316b4cc250da
Size

2.3MB
Sample

241026-xqp21avqgq
MD5

7a7a7c876f642137056271817db6109a
SHA1

0833452d4ca169c1a12ce0ce0ef5f408b510b7f6
SHA256

1a1a61ea96f734f572ce0836182585ea0533c87c50a68dccb43d316b4cc250da
SHA512

9795110b5dd6f196a48bbfb592b4e8ad02350cc6e5e067586187f0a5991e4d93c9f471fe29b6f8f1c048a3a784ac5bccd249a999fc26f70b58982fa349f9c4fb
SSDEEP

49152:BYTfguaGh8Tp4V1agUaL5P7bIsD/jhvn/4XtYbZ9xrsheHx9:BBGh+p257hHIsLtvn/4dmDrs4x

Score

10^/10

Malware Config

Targets

- Target
  
  1a1a61ea96f734f572ce0836182585ea0533c87c50a68dccb43d316b4cc250da
- Size
  
  2.3MB
- MD5
  
  7a7a7c876f642137056271817db6109a
- SHA1
  
  0833452d4ca169c1a12ce0ce0ef5f408b510b7f6
- SHA256
  
  1a1a61ea96f734f572ce0836182585ea0533c87c50a68dccb43d316b4cc250da
- SHA512
  
  9795110b5dd6f196a48bbfb592b4e8ad02350cc6e5e067586187f0a5991e4d93c9f471fe29b6f8f1c048a3a784ac5bccd249a999fc26f70b58982fa349f9c4fb
- SSDEEP
  
  49152:BYTfguaGh8Tp4V1agUaL5P7bIsD/jhvn/4XtYbZ9xrsheHx9:BBGh+p257hHIsLtvn/4dmDrs4x
Score

10^/10

redline sectoprat discovery evasion execution infostealer rat themida trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Redline family
  redline
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Sectoprat family
  sectoprat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2