Overview

overview

10

Static

static

3

ec10183add...1f.exe

windows7-x64

10

ec10183add...1f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ec10183addba250bd0719de70ec48a66b62fabed11b0be94c0b59575e520aa1f.bin

  • Size

    1000KB

  • Sample

    230501-xpjhtsge6w

  • MD5

    1ada348db7d30af948a546a656b53ddf

  • SHA1

    a0a0120445d1c1baa8e44e45caa7c43acc5aa2b2

  • SHA256

    ec10183addba250bd0719de70ec48a66b62fabed11b0be94c0b59575e520aa1f

  • SHA512

    f99b6c177a36b7ed1bb2e5466f435ddae3332919a74a5c9f417e4e556b9444e2699c322053553b9d62d2cea0269964fbb165dad3fbdfa354db5a6abe3a04612d

  • SSDEEP

    24576:zTLrvnFOPYjIA0NCw+J3Hl+yV5vCoyvIc5zlYWSSpb:7rvFqYjbfJV+QvCoyZzt9p

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      ec10183addba250bd0719de70ec48a66b62fabed11b0be94c0b59575e520aa1f.bin

    • Size

      1000KB

    • MD5

      1ada348db7d30af948a546a656b53ddf

    • SHA1

      a0a0120445d1c1baa8e44e45caa7c43acc5aa2b2

    • SHA256

      ec10183addba250bd0719de70ec48a66b62fabed11b0be94c0b59575e520aa1f

    • SHA512

      f99b6c177a36b7ed1bb2e5466f435ddae3332919a74a5c9f417e4e556b9444e2699c322053553b9d62d2cea0269964fbb165dad3fbdfa354db5a6abe3a04612d

    • SSDEEP

      24576:zTLrvnFOPYjIA0NCw+J3Hl+yV5vCoyvIc5zlYWSSpb:7rvFqYjbfJV+QvCoyZzt9p

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks