Extracted

• • Target

    c652a26bf55e37df20be2acde2bf62e689fe74b639399cf05c745b6e99bf300e

  • Size

    2.2MB

  • MD5

    04a388c4eba299014229f1b9ad222bfa

  • SHA1

    8abbbca7933753fc6735bf0ce54e60aeb6175290

  • SHA256

    c652a26bf55e37df20be2acde2bf62e689fe74b639399cf05c745b6e99bf300e

  • SHA512

    264a93b0b54adc89a07c72b0a3367f72fe8460052f8f8445001538b7babe3d60bc747422002ff7db3c9d77479f97f72ca21593e549e804b19e3b69d7c283860a

  • SSDEEP

    24576:O2S7oUNCP2EnE8yi/ql/TM3eayHj03qEtAnXXrs2YHp9AzCAXEQ3x//1kvMaNzBl:2Dwci/ql7b3AqWr

  Score

  10^/10

  redlinenewdiscoveryevasioninfostealertrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2