Overview

overview

10

Static

static

3

c80b0b8293...e7.exe

windows7-x64

10

c80b0b8293...e7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c80b0b8293760057636532d4e111d33a755dcdd261cbfdd5af31e63b3545b4e7.bin

  • Size

    1000KB

  • Sample

    230505-x9fyfahf35

  • MD5

    2899e625fe11d176abaab63c22b6fc84

  • SHA1

    40eda4c8c8fa892b2e7bf482358b403b4a51429d

  • SHA256

    c80b0b8293760057636532d4e111d33a755dcdd261cbfdd5af31e63b3545b4e7

  • SHA512

    b3963b83d836ff3570de764c60b885c3abdf4caa816f6d65dec576564501b4fa303b9f357417a29048fe0d4623a8d75d5d6f38d3721afbc3bc1e2c42270c663a

  • SSDEEP

    24576:gTLrvnFOPYjIA0NCw+J3Hl+yV5vCoyvIc5zlYWSSpb:GrvFqYjbfJV+QvCoyZzt9p

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      c80b0b8293760057636532d4e111d33a755dcdd261cbfdd5af31e63b3545b4e7.bin

    • Size

      1000KB

    • MD5

      2899e625fe11d176abaab63c22b6fc84

    • SHA1

      40eda4c8c8fa892b2e7bf482358b403b4a51429d

    • SHA256

      c80b0b8293760057636532d4e111d33a755dcdd261cbfdd5af31e63b3545b4e7

    • SHA512

      b3963b83d836ff3570de764c60b885c3abdf4caa816f6d65dec576564501b4fa303b9f357417a29048fe0d4623a8d75d5d6f38d3721afbc3bc1e2c42270c663a

    • SSDEEP

      24576:gTLrvnFOPYjIA0NCw+J3Hl+yV5vCoyvIc5zlYWSSpb:GrvFqYjbfJV+QvCoyZzt9p

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks