Overview

overview

10

Static

static

3

f03e0af254...b2.exe

windows7-x64

10

f03e0af254...b2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f03e0af254a4154e0945799790722c0d7932eb1c2b957e39b19f710493fa13b2.bin

  • Size

    1.2MB

  • Sample

    230501-xygqlagg8y

  • MD5

    01754011f7bf25853bdadcc7c7b1d0ad

  • SHA1

    904d329a6db53ff96244b6c22c5780dc04e35994

  • SHA256

    f03e0af254a4154e0945799790722c0d7932eb1c2b957e39b19f710493fa13b2

  • SHA512

    ff04b5fb5c9e8fd576d6131332ebf70772f7cb3d6cfa95f6de464b97ff9c52db4e80eda65bcc52e2ef3544f5da529fec18cd868708c58e631c5bbacb34d5783a

  • SSDEEP

    24576:dO/ma41pNBrquMHuDpKqJUd5xYsLo11YdH/tFrQhldU8HJVYx+dblqaWSLO:dOXedEODpKqJGYsLMutFEIx257

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      f03e0af254a4154e0945799790722c0d7932eb1c2b957e39b19f710493fa13b2.bin

    • Size

      1.2MB

    • MD5

      01754011f7bf25853bdadcc7c7b1d0ad

    • SHA1

      904d329a6db53ff96244b6c22c5780dc04e35994

    • SHA256

      f03e0af254a4154e0945799790722c0d7932eb1c2b957e39b19f710493fa13b2

    • SHA512

      ff04b5fb5c9e8fd576d6131332ebf70772f7cb3d6cfa95f6de464b97ff9c52db4e80eda65bcc52e2ef3544f5da529fec18cd868708c58e631c5bbacb34d5783a

    • SSDEEP

      24576:dO/ma41pNBrquMHuDpKqJUd5xYsLo11YdH/tFrQhldU8HJVYx+dblqaWSLO:dOXedEODpKqJGYsLMutFEIx257

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks