Overview

overview

10

Static

static

3

e33725b46e...99.exe

windows7-x64

10

e33725b46e...99.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e33725b46e5140ec678d81b6c125008127123b2438bc8740dbb590ed04206299.bin

  • Size

    695KB

  • Sample

    230501-xh3ywsfh9t

  • MD5

    f9e647f68a1eb930386d5c2f82010fa7

  • SHA1

    d4ab95abbf07c271c2dce275d2680b0cab78778d

  • SHA256

    e33725b46e5140ec678d81b6c125008127123b2438bc8740dbb590ed04206299

  • SHA512

    bc9863d98d74a86beba8f41cf3fb322de936291f4bb4b7a62d5a39cb4999f317e09570492c68e55f769f329cbba323048167159488137ed21808943798d079b9

  • SSDEEP

    12288:Hy90l0E4Icxg/DY/+tZ9COgd5tlPhGMdgzWk63I18bzKwA+uUXFyq4:HySqkY/+tXCBp2b63I18bzzw/q4

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      e33725b46e5140ec678d81b6c125008127123b2438bc8740dbb590ed04206299.bin

    • Size

      695KB

    • MD5

      f9e647f68a1eb930386d5c2f82010fa7

    • SHA1

      d4ab95abbf07c271c2dce275d2680b0cab78778d

    • SHA256

      e33725b46e5140ec678d81b6c125008127123b2438bc8740dbb590ed04206299

    • SHA512

      bc9863d98d74a86beba8f41cf3fb322de936291f4bb4b7a62d5a39cb4999f317e09570492c68e55f769f329cbba323048167159488137ed21808943798d079b9

    • SSDEEP

      12288:Hy90l0E4Icxg/DY/+tZ9COgd5tlPhGMdgzWk63I18bzKwA+uUXFyq4:HySqkY/+tXCBp2b63I18bzzw/q4

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks