Extracted

• • Target

    System32.exe

  • Size

    5.3MB

  • MD5

    d4817ea043beaf35d19fa6a5adaa179c

  • SHA1

    bf5c75100142731e737c04b55769c4479bef0c01

  • SHA256

    da5844b02ebfa56b4c036ea50136e7766922fa1591d344130f5492e5624fdf5d

  • SHA512

    98d2f67523de2260cad45ce2b3f0e6edd5322ad4d2d78854983c3410398079f1a0dd3f8b3dc69d3e0f052c566de3eb89d1de9a086378f542b1a2096ce0730277

  • SSDEEP

    98304:euP+GgrLRHeOxxsJFoQYVCkOTfOKfKQMZ8htPwCakmxrcTZcV+TQB:l+GgLRJghYckmmKfFMZqtMkicZcV2e

  Score

  10^/10

  redlineducdiscoveryevasioninfostealerpersistencethemidatrojan

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2