Overview

overview

10

Static

static

3

e645817b2d...43.exe

windows7-x64

10

e645817b2d...43.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e645817b2de73e89c4e3263557c427c01e159a78848e997054da4d560f26ae43.bin

  • Size

    746KB

  • Sample

    230501-xkr96sed37

  • MD5

    94bb9c172a4c91ebf140a9eb833338b8

  • SHA1

    a17da9f20e4f3356c851f5f50b10d71d723cad35

  • SHA256

    e645817b2de73e89c4e3263557c427c01e159a78848e997054da4d560f26ae43

  • SHA512

    55fd943b5c959d817fd98936d3a9b92184e6f44ed788745611b7232639e9c5693eafc4e0da9bdbffd814e435b17d60dbfac6fcd5cb1c6147ce02d3052adbeee5

  • SSDEEP

    12288:Ly90LIf0wZNF9tizd+YFp+D4EbJKirF1DbF0/86b9y7uM9otk5Cd:Lye7wTEB+NDHfrFX0/86b9ylo3d

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      e645817b2de73e89c4e3263557c427c01e159a78848e997054da4d560f26ae43.bin

    • Size

      746KB

    • MD5

      94bb9c172a4c91ebf140a9eb833338b8

    • SHA1

      a17da9f20e4f3356c851f5f50b10d71d723cad35

    • SHA256

      e645817b2de73e89c4e3263557c427c01e159a78848e997054da4d560f26ae43

    • SHA512

      55fd943b5c959d817fd98936d3a9b92184e6f44ed788745611b7232639e9c5693eafc4e0da9bdbffd814e435b17d60dbfac6fcd5cb1c6147ce02d3052adbeee5

    • SSDEEP

      12288:Ly90LIf0wZNF9tizd+YFp+D4EbJKirF1DbF0/86b9y7uM9otk5Cd:Lye7wTEB+NDHfrFX0/86b9ylo3d

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks