Overview

overview

10

Static

static

3

d113a5c991...d8.exe

windows7-x64

10

d113a5c991...d8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d113a5c991b79a5ef59b79b2c69d9dcfc8d9e360f16ad0faeabc40b851c5a1d8.bin

  • Size

    1.2MB

  • Sample

    230501-w7vs5sdb38

  • MD5

    44b965fce74ff2e7bc61d8188268e83d

  • SHA1

    a51dfd29e29bfe1cb044b6d335588375e8c028ba

  • SHA256

    d113a5c991b79a5ef59b79b2c69d9dcfc8d9e360f16ad0faeabc40b851c5a1d8

  • SHA512

    6d3408cd4c3a62d5e9e623d54cc2fdc876317c546228f825a0e2ae2842124df22da962666e5e87c30ad36b166cc233f9032131699417269033fa8e3b167d8f0c

  • SSDEEP

    24576:bGxKz+TDUpS+Nmj4NGQpy6X6yzjKdFuU40KUcDL0lNp/bPm:bGMOKSUDNGQp9qKqFR4JUcDLqNp/b

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      d113a5c991b79a5ef59b79b2c69d9dcfc8d9e360f16ad0faeabc40b851c5a1d8.bin

    • Size

      1.2MB

    • MD5

      44b965fce74ff2e7bc61d8188268e83d

    • SHA1

      a51dfd29e29bfe1cb044b6d335588375e8c028ba

    • SHA256

      d113a5c991b79a5ef59b79b2c69d9dcfc8d9e360f16ad0faeabc40b851c5a1d8

    • SHA512

      6d3408cd4c3a62d5e9e623d54cc2fdc876317c546228f825a0e2ae2842124df22da962666e5e87c30ad36b166cc233f9032131699417269033fa8e3b167d8f0c

    • SSDEEP

      24576:bGxKz+TDUpS+Nmj4NGQpy6X6yzjKdFuU40KUcDL0lNp/bPm:bGMOKSUDNGQp9qKqFR4JUcDLqNp/b

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks