General

  • Target

    f3522da8e7e4cbb987ea9cf3aebc9401f48a7222e116102c27e1faf2c6b7b652.bin

  • Size

    747KB

  • Sample

    230501-xz4xhsfc48

  • MD5

    ab090819eeab59e2645dab3ec1e058c6

  • SHA1

    c18520b937bc3b45159022aa75cf8c5fdb59946a

  • SHA256

    f3522da8e7e4cbb987ea9cf3aebc9401f48a7222e116102c27e1faf2c6b7b652

  • SHA512

    fc25c099cb71ad7113e74c90ea2118139527b8292e58fc8e4b1a1ca8f8002e82a15ebfdb2f32f056266c1128abc17f09f83a22258ed12ea0f5cc7d23d276b82a

  • SSDEEP

    12288:ry90aIzhpkiDe6oLlSxxqVx9E5HrUKSAGsIZXpWT4VliFD:ryizcxLLjmIfh1pWT4VlMD

Malware Config

Targets

    • Target

      f3522da8e7e4cbb987ea9cf3aebc9401f48a7222e116102c27e1faf2c6b7b652.bin

    • Size

      747KB

    • MD5

      ab090819eeab59e2645dab3ec1e058c6

    • SHA1

      c18520b937bc3b45159022aa75cf8c5fdb59946a

    • SHA256

      f3522da8e7e4cbb987ea9cf3aebc9401f48a7222e116102c27e1faf2c6b7b652

    • SHA512

      fc25c099cb71ad7113e74c90ea2118139527b8292e58fc8e4b1a1ca8f8002e82a15ebfdb2f32f056266c1128abc17f09f83a22258ed12ea0f5cc7d23d276b82a

    • SSDEEP

      12288:ry90aIzhpkiDe6oLlSxxqVx9E5HrUKSAGsIZXpWT4VliFD:ryizcxLLjmIfh1pWT4VlMD

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks