redline

General

Target
245cceafa613c14d48cd7465b27ba993.exe
Size 75KB
Sample211007-pay1zacehj
SHA256 059afad6c9d4183c5b32b89465732dc6ea7bf7192c0ed7e9f1dabfe65a17da2e
MD5 245cceafa613c14d48cd7465b27ba993
SHA1 632a7f6e681b1ab5cb019c964d82d4aaba30fe82
SHA512 640a47f2b403073d273bc618c0ee74ecb08ea492128c4e96464536b9794e8d51fa3303b7c8befd961f0ccad64da450c67ed6eb3765bfcd75c36e936fceeb64e4
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  245cceafa613c14d48cd7465b27ba993.exe
- Size 75KB
- SHA256 059afad6c9d4183c5b32b89465732dc6ea7bf7192c0ed7e9f1dabfe65a17da2e
- MD5 245cceafa613c14d48cd7465b27ba993
- SHA1 632a7f6e681b1ab5cb019c964d82d4aaba30fe82
- SHA512 640a47f2b403073d273bc618c0ee74ecb08ea492128c4e96464536b9794e8d51fa3303b7c8befd961f0ccad64da450c67ed6eb3765bfcd75c36e936fceeb64e4
- MD5 SHA1 SHA512
Score

10^/10

redline discovery evasion infostealer persistence spyware stealer themida trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2