Overview

overview

10

Static

static

3

da28fa81da...7f.exe

windows7-x64

10

da28fa81da...7f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    da28fa81da742a4e78b80bbe9d3e23344cbf98f48a51c890fb0e8eb62444dd7f.bin

  • Size

    747KB

  • Sample

    230501-xcfw6sdf52

  • MD5

    d355f51d160e6f42ea63ed429d2107be

  • SHA1

    9934f23ceeddcbbebf3f09a58adb4a3b5cea6e4a

  • SHA256

    da28fa81da742a4e78b80bbe9d3e23344cbf98f48a51c890fb0e8eb62444dd7f

  • SHA512

    d431ca2dced51410c2910ccdb344d560eea0b1ab67ddb39e838470b781e48d0f65f999fd1a6267fad771d07cb85d973bb862821c16c6549e8d2ab389eca4c125

  • SSDEEP

    12288:Xy90sSSyGYdJXORyCo46fGGXO267tWIjDht6W9TeBtHYD+akZvUvfB:XyNSSa+po46fJO267wIjDhtdWHYaaJv5

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      da28fa81da742a4e78b80bbe9d3e23344cbf98f48a51c890fb0e8eb62444dd7f.bin

    • Size

      747KB

    • MD5

      d355f51d160e6f42ea63ed429d2107be

    • SHA1

      9934f23ceeddcbbebf3f09a58adb4a3b5cea6e4a

    • SHA256

      da28fa81da742a4e78b80bbe9d3e23344cbf98f48a51c890fb0e8eb62444dd7f

    • SHA512

      d431ca2dced51410c2910ccdb344d560eea0b1ab67ddb39e838470b781e48d0f65f999fd1a6267fad771d07cb85d973bb862821c16c6549e8d2ab389eca4c125

    • SSDEEP

      12288:Xy90sSSyGYdJXORyCo46fGGXO267tWIjDht6W9TeBtHYD+akZvUvfB:XyNSSa+po46fJO267wIjDhtdWHYaaJv5

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks