General
- Target arm4.elf
- Size 74KB
- Sample261009-v8eb4sct6v
- SHA256 3e7098bca0291ab3cacdf5f557b2cb01de9641d8886b7f9e2239941a87ce13a6
Score
10/10
Malware Config
Targets
-
- Target arm4.elf
- Size 74KB
- SHA256 3e7098bca0291ab3cacdf5f557b2cb01de9641d8886b7f9e2239941a87ce13a6
Score10/10-
Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Contacts a large (757657) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Renames itself
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads MAC address of network interface
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
-
Reads network interface configuration
Fetches information about one or more active network interfaces.