General
-
Target
92090b43bcb255f983acad4f9240e7255282e536e94add116054f348801ea5d4
-
Size
480KB
-
Sample
230505-w9tzmaea74
-
MD5
a137bb6a99bd945048bb067e6c18204c
-
SHA1
ddef44df120be55a176c45c15c788b3e0530418a
-
SHA256
92090b43bcb255f983acad4f9240e7255282e536e94add116054f348801ea5d4
-
SHA512
f193defc58cf9919f68599f7bc494609f169d84a952dcf2820fefb841aaae54863fd92bbd801fa6cfb1f77232619c93b3a5ec38def483d4a0c1c69f42f3d792d
-
SSDEEP
12288:UMrXy90mFFckf9u6vVtzKNPoCXDOu8BrLuJpZNy:Dyjcuu6vzKFrzwpaJY
Malware Config
Targets
-
-
Target
92090b43bcb255f983acad4f9240e7255282e536e94add116054f348801ea5d4
-
Size
480KB
-
MD5
a137bb6a99bd945048bb067e6c18204c
-
SHA1
ddef44df120be55a176c45c15c788b3e0530418a
-
SHA256
92090b43bcb255f983acad4f9240e7255282e536e94add116054f348801ea5d4
-
SHA512
f193defc58cf9919f68599f7bc494609f169d84a952dcf2820fefb841aaae54863fd92bbd801fa6cfb1f77232619c93b3a5ec38def483d4a0c1c69f42f3d792d
-
SSDEEP
12288:UMrXy90mFFckf9u6vVtzKNPoCXDOu8BrLuJpZNy:Dyjcuu6vzKFrzwpaJY
Score10/10-
Detects Redline Stealer samples
This rule detects the presence of Redline Stealer samples based on their unique strings.
-
Modifies Windows Defender Real-time Protection settings
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-