Overview

overview

10

Static

static

16f4a3fc69...a3.exe

windows7_x64

10

16f4a3fc69...a3.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    16f4a3fc69b8b2b64db781127f898729b4ea712c835a3.exe
  • Size 4.4MB
  • Sample220406-g4wtpsbcd2
  • SHA256 16f4a3fc69b8b2b64db781127f898729b4ea712c835a3ffc8b25021106f8245c
  • MD5 SHA1 SHA512
Score
10/10
redlinefilinnn1evasioninfostealerspywaretrojan

Malware Config

Extracted

Family

  • redline

Botnet

  • filinnn1

C2

  • 5.45.77.29:41494

Attributes
  • auth_value

    da347df57c88b125ede510dbe7fcc0f4

Targets

    • Target
      16f4a3fc69b8b2b64db781127f898729b4ea712c835a3.exe
    • Size 4.4MB
    • SHA256 16f4a3fc69b8b2b64db781127f898729b4ea712c835a3ffc8b25021106f8245c
    • MD5 SHA1 SHA512
    Score
    10/10
    redlinefilinnn1evasioninfostealerspywaretrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks