General
-
Target
46a77609aef12de578b872298e83e820cfcfa891e34b8a254f5c01ddc20313ef
-
Size
480KB
-
Sample
230505-wzmskacg64
-
MD5
52fd795dcd178e6dbe8aaf27d9aeea40
-
SHA1
2d81d49e1afcd44e1170f95fde368cb3d752632e
-
SHA256
46a77609aef12de578b872298e83e820cfcfa891e34b8a254f5c01ddc20313ef
-
SHA512
ea70ab7ba5a43fc202cc70684384937ca44d71b1384dab9b6312e8c1f59e53489ff93535734e5ace145a878c31dd5e9d85d02786c04947122c038f90dcbf110f
-
SSDEEP
6144:Kry+bnr+6p0yN90QENxjvCUkWsjZNoW7p6BBK5Srg2FANwjMH+Fy6CdH06Pp2EY7:hMrmy907B4lHWFAArFaluyJqhB
Malware Config
Targets
-
-
Target
46a77609aef12de578b872298e83e820cfcfa891e34b8a254f5c01ddc20313ef
-
Size
480KB
-
MD5
52fd795dcd178e6dbe8aaf27d9aeea40
-
SHA1
2d81d49e1afcd44e1170f95fde368cb3d752632e
-
SHA256
46a77609aef12de578b872298e83e820cfcfa891e34b8a254f5c01ddc20313ef
-
SHA512
ea70ab7ba5a43fc202cc70684384937ca44d71b1384dab9b6312e8c1f59e53489ff93535734e5ace145a878c31dd5e9d85d02786c04947122c038f90dcbf110f
-
SSDEEP
6144:Kry+bnr+6p0yN90QENxjvCUkWsjZNoW7p6BBK5Srg2FANwjMH+Fy6CdH06Pp2EY7:hMrmy907B4lHWFAArFaluyJqhB
Score10/10-
Detects Redline Stealer samples
This rule detects the presence of Redline Stealer samples based on their unique strings.
-
Modifies Windows Defender Real-time Protection settings
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-