Extracted

• • Target

    aa6ca1da68b711a534cdae77c39382d6f020679a7ea56e1563bae1a3c9342d0f

  • Size

    720KB

  • MD5

    c39dc176515df061ae18dac5290a421b

  • SHA1

    9a40112771df95fd291b3c655200f4526f1b681a

  • SHA256

    aa6ca1da68b711a534cdae77c39382d6f020679a7ea56e1563bae1a3c9342d0f

  • SHA512

    67cef282c93324d5c57d9635415af6721b79b0b2b9ccc1fdda618c2287c78448732378b788452cdc2b8abb592eafc9fac71922c60aae105c311a3e59ab2c1987

  • SSDEEP

    12288:EsZjDQffIkegET9jsIBMNjnNNOhAe/S0JiD2trLwYckJ2U02abFTxJlO6VVUF0mW:NgoTsIBMNjnNNOhAe/S0JU2Z9J9mzlOs

  Score

  10^/10

  redlinenewsdefense_evasiondiscoveryinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2