Overview

overview

10

Static

static

3

dd8a9f6fd3...e8.exe

windows7-x64

10

dd8a9f6fd3...e8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    dd8a9f6fd3479437ce824114d87688e8.exe.bin

  • Size

    990KB

  • Sample

    230501-xec83afe8v

  • MD5

    dd8a9f6fd3479437ce824114d87688e8

  • SHA1

    ae746fd8c8e25195f0ea2df4de836c6d92da3653

  • SHA256

    a36fee86748e115092bfcbc23922fd1541b982fdf614dd9651fa753a24902753

  • SHA512

    f1e7a0a805e244e7f933cb7ae18049bd9d113f8cb70e821b4251ea174778a513eab60e2870c18f38e96e4220dee9adef895df3313d134859d3507219bf839d24

  • SSDEEP

    24576:pnUoY7pfy8Yg7Q7TsRZcKeD2Mzlnk+IY8Mlf:87By87STskKefd5

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      dd8a9f6fd3479437ce824114d87688e8.exe.bin

    • Size

      990KB

    • MD5

      dd8a9f6fd3479437ce824114d87688e8

    • SHA1

      ae746fd8c8e25195f0ea2df4de836c6d92da3653

    • SHA256

      a36fee86748e115092bfcbc23922fd1541b982fdf614dd9651fa753a24902753

    • SHA512

      f1e7a0a805e244e7f933cb7ae18049bd9d113f8cb70e821b4251ea174778a513eab60e2870c18f38e96e4220dee9adef895df3313d134859d3507219bf839d24

    • SSDEEP

      24576:pnUoY7pfy8Yg7Q7TsRZcKeD2Mzlnk+IY8Mlf:87By87STskKefd5

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks