redline | 14819525fa27bc2fa89cbd59ffa93378c730b0d3fc26f14bf937a03c3e48d357 | Triage

Submit
Reports

Overview

overview

Static

static

3

14819525fa...57.exe

windows7-x64

14819525fa...57.exe

windows10-2004-x64

Sharing

General

Target

14819525fa27bc2fa89cbd59ffa93378c730b0d3fc26f14bf937a03c3e48d357
Size

707KB
Sample

230505-wr74jaca29
MD5

1d710ff93a7b6577b9c6afd7e7633cbf
SHA1

dc04608b501d9843ca9be9b5b7aa00ed6597d92f
SHA256

14819525fa27bc2fa89cbd59ffa93378c730b0d3fc26f14bf937a03c3e48d357
SHA512

191f58cf9bd3200ce4a1039bd19a8d22872071a338e12e00015fd6ef100b33f9252d59f2e3960483dec54e3aada76674dd1b9c364bfdf3136a6587e5aaf2437a
SSDEEP

12288:CMrUy90lTvxTJjGZV/h7Si1a1YKzbAflwIwWNEyyXOVzauWTkii77mcPJ6F5RdZ3:+y+AV/7Kzb2lwcNeXOVz2wii77mcB6jl

Score

10^/10

redline discovery evasion infostealer persistence spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

14819525fa27bc2fa89cbd59ffa93378c730b0d3fc26f14bf937a03c3e48d357.exe

Resource

win7-20230220-en

discovery evasion persistence spyware stealer trojan

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

14819525fa27bc2fa89cbd59ffa93378c730b0d3fc26f14bf937a03c3e48d357.exe

Resource

win10v2004-20230221-en

redline infostealer persistence stealer

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  14819525fa27bc2fa89cbd59ffa93378c730b0d3fc26f14bf937a03c3e48d357
- Size
  
  707KB
- MD5
  
  1d710ff93a7b6577b9c6afd7e7633cbf
- SHA1
  
  dc04608b501d9843ca9be9b5b7aa00ed6597d92f
- SHA256
  
  14819525fa27bc2fa89cbd59ffa93378c730b0d3fc26f14bf937a03c3e48d357
- SHA512
  
  191f58cf9bd3200ce4a1039bd19a8d22872071a338e12e00015fd6ef100b33f9252d59f2e3960483dec54e3aada76674dd1b9c364bfdf3136a6587e5aaf2437a
- SSDEEP
  
  12288:CMrUy90lTvxTJjGZV/h7Si1a1YKzbAflwIwWNEyyXOVzauWTkii77mcPJ6F5RdZ3:+y+AV/7Kzb2lwcNeXOVz2wii77mcB6jl
Score

10^/10

discovery evasion persistence spyware stealer trojan redline infostealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan

behavioral2

redlineinfostealerpersistencestealer

© 2018-2025

Terms | Privacy