General
-
Target
65e927b43ad5e5c9e01570c197da93530191b622d90abad16e486d69157942b9
-
Size
599KB
-
Sample
230505-w4l2tsdc87
-
MD5
9fcf210a9e62502d2332c6cf658b50d5
-
SHA1
91ed85654df42d0f41c02cc344bac9f11c858f34
-
SHA256
65e927b43ad5e5c9e01570c197da93530191b622d90abad16e486d69157942b9
-
SHA512
ebbb43549280464616956cfa60d1755deeaf0918c46f1023f7c8c0105b1362b267b9190cb49eabadf9f04618d14d8a21cdb2810ffedbadfb33ecdf916146774c
-
SSDEEP
12288:sMrSy90mYT6rZjgyo7HoX1Id3CWyEh62U2+6cWCLxCs88Zpg2FaUOZ/t:OymTmJyHgasPv2RwK2bO7
Malware Config
Targets
-
-
Target
65e927b43ad5e5c9e01570c197da93530191b622d90abad16e486d69157942b9
-
Size
599KB
-
MD5
9fcf210a9e62502d2332c6cf658b50d5
-
SHA1
91ed85654df42d0f41c02cc344bac9f11c858f34
-
SHA256
65e927b43ad5e5c9e01570c197da93530191b622d90abad16e486d69157942b9
-
SHA512
ebbb43549280464616956cfa60d1755deeaf0918c46f1023f7c8c0105b1362b267b9190cb49eabadf9f04618d14d8a21cdb2810ffedbadfb33ecdf916146774c
-
SSDEEP
12288:sMrSy90mYT6rZjgyo7HoX1Id3CWyEh62U2+6cWCLxCs88Zpg2FaUOZ/t:OymTmJyHgasPv2RwK2bO7
Score10/10-
Detects Redline Stealer samples
This rule detects the presence of Redline Stealer samples based on their unique strings.
-
Modifies Windows Defender Real-time Protection settings
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-