Overview

overview

10

Static

static

3

d8465d9710...13.exe

windows7-x64

10

d8465d9710...13.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d8465d97107ca069d80c3fac02157c731821846c7cb7be182e516290e6c34c13.bin

  • Size

    746KB

  • Sample

    230501-xbgr3sfc2z

  • MD5

    bac56e5bee2c813dec36f255fca4b77b

  • SHA1

    ea42c5050c37f69a707febdf109f038fca4fd1e5

  • SHA256

    d8465d97107ca069d80c3fac02157c731821846c7cb7be182e516290e6c34c13

  • SHA512

    78e477a843dc4944c1eb22b9f53dc2430fb6fc84c9c396125b6425d343ee50fa3e062e629b2a43d27ddd292dd9d23e5092e2be4e4e2f03b47878f350c4166b7c

  • SSDEEP

    12288:Ly90t/0gHCK9BdSg15+vuNzwEzr3BLGSONEFqs9uJMCSgJ6mkfP1aGK:LymNTxTz1rF5MGgJsfP1aGK

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      d8465d97107ca069d80c3fac02157c731821846c7cb7be182e516290e6c34c13.bin

    • Size

      746KB

    • MD5

      bac56e5bee2c813dec36f255fca4b77b

    • SHA1

      ea42c5050c37f69a707febdf109f038fca4fd1e5

    • SHA256

      d8465d97107ca069d80c3fac02157c731821846c7cb7be182e516290e6c34c13

    • SHA512

      78e477a843dc4944c1eb22b9f53dc2430fb6fc84c9c396125b6425d343ee50fa3e062e629b2a43d27ddd292dd9d23e5092e2be4e4e2f03b47878f350c4166b7c

    • SSDEEP

      12288:Ly90t/0gHCK9BdSg15+vuNzwEzr3BLGSONEFqs9uJMCSgJ6mkfP1aGK:LymNTxTz1rF5MGgJsfP1aGK

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks