Overview

overview

10

Static

static

3

e73932edf5...ad.exe

windows7-x64

10

e73932edf5...ad.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e73932edf5f7c5ce6ebdb526b98126e3141f0bf26e4fa8da8db5d0ae875383ad.bin

  • Size

    1.1MB

  • Sample

    230501-xk9t8aed74

  • MD5

    470dedb8feeee3c0136578401501f3ff

  • SHA1

    a94b25fdb91fee308faa0459facceac4f860a1e5

  • SHA256

    e73932edf5f7c5ce6ebdb526b98126e3141f0bf26e4fa8da8db5d0ae875383ad

  • SHA512

    d3fe4afe38cb88072084874bd46df42da7ab742880bd364d5ed981edb47b8ba907af4fedb3618c5786b9fec4cffc79d99245d8a0212b468514d8aaa98c45077e

  • SSDEEP

    24576:Myr35ltFkkvMIqz9Sn18UWQMiOPniEQUAlpdBUwWKQ4i:7r3ntikvXA49WviORQBpdBUed

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      e73932edf5f7c5ce6ebdb526b98126e3141f0bf26e4fa8da8db5d0ae875383ad.bin

    • Size

      1.1MB

    • MD5

      470dedb8feeee3c0136578401501f3ff

    • SHA1

      a94b25fdb91fee308faa0459facceac4f860a1e5

    • SHA256

      e73932edf5f7c5ce6ebdb526b98126e3141f0bf26e4fa8da8db5d0ae875383ad

    • SHA512

      d3fe4afe38cb88072084874bd46df42da7ab742880bd364d5ed981edb47b8ba907af4fedb3618c5786b9fec4cffc79d99245d8a0212b468514d8aaa98c45077e

    • SSDEEP

      24576:Myr35ltFkkvMIqz9Sn18UWQMiOPniEQUAlpdBUwWKQ4i:7r3ntikvXA49WviORQBpdBUed

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks