General
-
Target
5fe65a2703f1db9ffe74a8732e5e5a88359759c76a92d27ef91a053f186a365e
-
Size
480KB
-
Sample
230505-w3zarsfc4v
-
MD5
70eb79e785b32ed55a57ada2ec02c6f2
-
SHA1
5171154c989dcc6abede28483b807a58167f801b
-
SHA256
5fe65a2703f1db9ffe74a8732e5e5a88359759c76a92d27ef91a053f186a365e
-
SHA512
426c6de6a1a1a86356249ae7098796a174e1b418eac978e046ecc486d02062119473a13d6652dd1340d6e53b8702b73ef700661fcd5fea57636e8102f08d8dff
-
SSDEEP
6144:KTy+bnr+Ip0yN90QEIz1BsBtqoa4fYTX1WFTdprbAi4vAdy4APjfZ+EeCxdmIAfI:hMrsy90CnsXxVoX1IZ4hjy+sBvCe8
Malware Config
Targets
-
-
Target
5fe65a2703f1db9ffe74a8732e5e5a88359759c76a92d27ef91a053f186a365e
-
Size
480KB
-
MD5
70eb79e785b32ed55a57ada2ec02c6f2
-
SHA1
5171154c989dcc6abede28483b807a58167f801b
-
SHA256
5fe65a2703f1db9ffe74a8732e5e5a88359759c76a92d27ef91a053f186a365e
-
SHA512
426c6de6a1a1a86356249ae7098796a174e1b418eac978e046ecc486d02062119473a13d6652dd1340d6e53b8702b73ef700661fcd5fea57636e8102f08d8dff
-
SSDEEP
6144:KTy+bnr+Ip0yN90QEIz1BsBtqoa4fYTX1WFTdprbAi4vAdy4APjfZ+EeCxdmIAfI:hMrsy90CnsXxVoX1IZ4hjy+sBvCe8
Score10/10-
Detects Redline Stealer samples
This rule detects the presence of Redline Stealer samples based on their unique strings.
-
Modifies Windows Defender Real-time Protection settings
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-