Overview

overview

10

Static

static

3

c803bcc5c7...20.exe

windows7-x64

10

c803bcc5c7...20.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c803bcc5c7529aa629c504b6a965bb70823e13bf3beffd4cb6ba49de201a1820.bin

  • Size

    642KB

  • Sample

    230505-x9e15shf32

  • MD5

    01df51fb5593fc12c7566083f96df054

  • SHA1

    b24e58879b339d4a9a7cfcf45de5a98bf4b40b9a

  • SHA256

    c803bcc5c7529aa629c504b6a965bb70823e13bf3beffd4cb6ba49de201a1820

  • SHA512

    15a481958513e2af92066e3d012a82fa3edec36b2235ce87bc386153596414e1ff0eedb2ac412f84a3c02b8bd1216da4a1d8dcfaa67f4fa0cb3756c9764f8305

  • SSDEEP

    12288:Ky90s+tlyhphOhg5t31W2LSyDicXqwZgFr4UC5JIABe:Kyd+WpIiv1QtcawZlPIAM

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      c803bcc5c7529aa629c504b6a965bb70823e13bf3beffd4cb6ba49de201a1820.bin

    • Size

      642KB

    • MD5

      01df51fb5593fc12c7566083f96df054

    • SHA1

      b24e58879b339d4a9a7cfcf45de5a98bf4b40b9a

    • SHA256

      c803bcc5c7529aa629c504b6a965bb70823e13bf3beffd4cb6ba49de201a1820

    • SHA512

      15a481958513e2af92066e3d012a82fa3edec36b2235ce87bc386153596414e1ff0eedb2ac412f84a3c02b8bd1216da4a1d8dcfaa67f4fa0cb3756c9764f8305

    • SSDEEP

      12288:Ky90s+tlyhphOhg5t31W2LSyDicXqwZgFr4UC5JIABe:Kyd+WpIiv1QtcawZlPIAM

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks