Extracted

• • Target

    4a5a06285aa0ca763229078bfd26a081ed8c41c90b4808155797dcbabbed4188.exe

  • Size

    1.9MB

  • MD5

    c14acb469b8ab6888d9f221732ac9fd5

  • SHA1

    fe32dd83b34b46e3a3d20ee4992b5a00b9f21b2b

  • SHA256

    4a5a06285aa0ca763229078bfd26a081ed8c41c90b4808155797dcbabbed4188

  • SHA512

    cf969a2680a14352de5c736a2e485f7b295ae44ebed59458ba7f988e6c1f3cc16e014c41b9f1433680af00c3547a0c032839b2b3e41693b4bc82c21c44d79eaf

  • SSDEEP

    49152:rIZKmmqn9SQ3Og96W3hPy8oQn+3k31FX5WeoA:reKmmgSQ3b6WHgklFdoA

  Score

  10^/10

  redlineb197ffdef2ddc3308584dce7afa3661bdefense_evasiondiscoveryinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Redline family

    redline

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2