redline

General

Target

9dfc8f1ddcebee300b0170ddcce671840386e20d7de566de5560ec4997ab3459
Size

590KB
Sample

230505-xb87bsed26
MD5

19b833678c3c27ae48d68776b5b15b3c
SHA1

285ca45f41ac463a4e2ce25df9d758c29c963e71
SHA256

9dfc8f1ddcebee300b0170ddcce671840386e20d7de566de5560ec4997ab3459
SHA512

39d97fcde67025df754f9da5fa17e012116607a71561a10ecd688e14f52e9bf0ef43926f3ea2b6e057410b0841754ec8e41d6d46b19d4ed00cabcba81e42bd2f
SSDEEP

12288:/Mrny90VVX8/nEa7+KaeEDPNRs8djqKHIb2RS9FO/cR1Dw67qnX:0ymVM8a7+KvEDPQ8djqygFFIcR1DwvX

Score

10^/10

Malware Config

Targets

- Target
  
  9dfc8f1ddcebee300b0170ddcce671840386e20d7de566de5560ec4997ab3459
- Size
  
  590KB
- MD5
  
  19b833678c3c27ae48d68776b5b15b3c
- SHA1
  
  285ca45f41ac463a4e2ce25df9d758c29c963e71
- SHA256
  
  9dfc8f1ddcebee300b0170ddcce671840386e20d7de566de5560ec4997ab3459
- SHA512
  
  39d97fcde67025df754f9da5fa17e012116607a71561a10ecd688e14f52e9bf0ef43926f3ea2b6e057410b0841754ec8e41d6d46b19d4ed00cabcba81e42bd2f
- SSDEEP
  
  12288:/Mrny90VVX8/nEa7+KaeEDPNRs8djqKHIb2RS9FO/cR1Dw67qnX:0ymVM8a7+KvEDPQ8djqygFFIcR1DwvX
Score

10^/10

discovery evasion persistence spyware stealer trojan redline infostealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2