Overview

overview

10

Static

static

3

a1988ffeaf...5a.exe

windows7-x64

10

a1988ffeaf...5a.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a1988ffeaf5c8500aa928591bc2e0ad0c410a1349b110866866a68d8d0aee85a.bin

  • Size

    1.1MB

  • Sample

    230505-xea4psgg2x

  • MD5

    89a29801f811f71cddd35dbcea7ced59

  • SHA1

    c1f96c7c441190b5b1b4d5649edc93af2d58c0e3

  • SHA256

    a1988ffeaf5c8500aa928591bc2e0ad0c410a1349b110866866a68d8d0aee85a

  • SHA512

    e55832010084becfa320ac7db7a64dd72337365124dc1ca72ec61aa07d5a422539f0d47ca5f3683c50de62e8eb726f62095e4c04b3502845cad30083f3ef68dc

  • SSDEEP

    24576:yysDDOIpjKTUnhHouk3Jj1HyKWtLqbhML0y0ssW37jyU6WKnQ7mTJ1yz6:Zsd+TUhHop3197WR+Qwu7jyUwnQ7CUz

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      a1988ffeaf5c8500aa928591bc2e0ad0c410a1349b110866866a68d8d0aee85a.bin

    • Size

      1.1MB

    • MD5

      89a29801f811f71cddd35dbcea7ced59

    • SHA1

      c1f96c7c441190b5b1b4d5649edc93af2d58c0e3

    • SHA256

      a1988ffeaf5c8500aa928591bc2e0ad0c410a1349b110866866a68d8d0aee85a

    • SHA512

      e55832010084becfa320ac7db7a64dd72337365124dc1ca72ec61aa07d5a422539f0d47ca5f3683c50de62e8eb726f62095e4c04b3502845cad30083f3ef68dc

    • SSDEEP

      24576:yysDDOIpjKTUnhHouk3Jj1HyKWtLqbhML0y0ssW37jyU6WKnQ7mTJ1yz6:Zsd+TUhHop3197WR+Qwu7jyUwnQ7CUz

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks