Overview

overview

10

Static

static

3

f0b7825273...ed.exe

windows7-x64

10

f0b7825273...ed.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f0b78252737ae6571dcccfacbab523c623f01523361d96e5e1e43ba18142cbed.bin

  • Size

    1000KB

  • Sample

    230501-xyn5nsgg9z

  • MD5

    742d6463ae7f86d76f129285d0272785

  • SHA1

    8a88b801bcbd8a418ddadd592b37de47da218c41

  • SHA256

    f0b78252737ae6571dcccfacbab523c623f01523361d96e5e1e43ba18142cbed

  • SHA512

    5392cffdb2218cab516939b4f30d4c6e3a4c7e5c0c627c178a574f149970ef385691ba1446606273ccadcfb6ab13bbb63eb149699122df5a5d841f8d7bfa13de

  • SSDEEP

    24576:ETLrvnFOPYjIA0NCw+J3Hl+yV5vCoyvIc5zlYWSSpb:qrvFqYjbfJV+QvCoyZzt9p

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      f0b78252737ae6571dcccfacbab523c623f01523361d96e5e1e43ba18142cbed.bin

    • Size

      1000KB

    • MD5

      742d6463ae7f86d76f129285d0272785

    • SHA1

      8a88b801bcbd8a418ddadd592b37de47da218c41

    • SHA256

      f0b78252737ae6571dcccfacbab523c623f01523361d96e5e1e43ba18142cbed

    • SHA512

      5392cffdb2218cab516939b4f30d4c6e3a4c7e5c0c627c178a574f149970ef385691ba1446606273ccadcfb6ab13bbb63eb149699122df5a5d841f8d7bfa13de

    • SSDEEP

      24576:ETLrvnFOPYjIA0NCw+J3Hl+yV5vCoyvIc5zlYWSSpb:qrvFqYjbfJV+QvCoyZzt9p

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks