Extracted

• • Target
    2025-08-08_9687ee8ef3fbf0096b8b409dc7098e13_black-basta_hijackloader_luca-stealer
  • Size 9.1MB
  • SHA256 c98dfbd927e9b720b834d273d481795069ec55cbc30c22ea4387e791eb8172d4
  • MD5 9687ee8ef3fbf0096b8b409dc7098e13
  • SHA1 b0570ecc1033e8199ec5ed0d5b10a75a017b359a
  • SHA512 c73f2219b0e68b4b8301e61e908b62aff2e6efe93b3cb50a0f06735fb26ba76ee657e2de0e60848b5cca0e52170218bc184e67c8bb0323cb0aef56a3f6fc2d10
  • SSDEEP 196608:SfuLcT+3fOv1Trt9YurHeD9BKG+5fc2S/ErXKEtw+R/oH8MsqfTmd8:ATOOvNB9YuyDvV+53SM8+RgzD+8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinemain_builddefense_evasiondiscoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Redline family

    redline

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2