Overview

overview

10

Static

static

3

d5773aea7c...0a.exe

windows7-x64

10

d5773aea7c...0a.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d5773aea7c6453e3485cdb84913ef2fda12d8d86c6fde967a1f819edcda8370a.bin

  • Size

    1.1MB

  • Sample

    230501-w96cnadd32

  • MD5

    091d589597c5bf0e2b5d31bd98d4b9f8

  • SHA1

    a6593f9901d09f230d54dc7f9c87f34acb540081

  • SHA256

    d5773aea7c6453e3485cdb84913ef2fda12d8d86c6fde967a1f819edcda8370a

  • SHA512

    36ab9b7cb656a3b862aa13a34094dc21f673ae846e7a7c64a0695c1cae65dc5beaa5a3ca531d94849bec7178a6a6c603f00a3b13fd456d9f0f7783f7596de559

  • SSDEEP

    24576:NyocwXSScfanLh19x6018Etyn44Ixv0X/Rgu:o7wXEE5cgHyn9IR0PR

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      d5773aea7c6453e3485cdb84913ef2fda12d8d86c6fde967a1f819edcda8370a.bin

    • Size

      1.1MB

    • MD5

      091d589597c5bf0e2b5d31bd98d4b9f8

    • SHA1

      a6593f9901d09f230d54dc7f9c87f34acb540081

    • SHA256

      d5773aea7c6453e3485cdb84913ef2fda12d8d86c6fde967a1f819edcda8370a

    • SHA512

      36ab9b7cb656a3b862aa13a34094dc21f673ae846e7a7c64a0695c1cae65dc5beaa5a3ca531d94849bec7178a6a6c603f00a3b13fd456d9f0f7783f7596de559

    • SSDEEP

      24576:NyocwXSScfanLh19x6018Etyn44Ixv0X/Rgu:o7wXEE5cgHyn9IR0PR

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks