Overview

overview

10

Static

static

3

af37016bed...19.exe

windows7-x64

10

af37016bed...19.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    af37016bed7a28ab28ed038685f75a7d6536b6acb0161e0ff49b89c080d03019.bin

  • Size

    1.1MB

  • Sample

    230505-xntbmsff57

  • MD5

    0c308c9934aa87cb5f53b8eeb67e2172

  • SHA1

    e60f090cc2de04bdb0f941ee71f91acce0687e16

  • SHA256

    af37016bed7a28ab28ed038685f75a7d6536b6acb0161e0ff49b89c080d03019

  • SHA512

    c12f5c9480790b0416ad100f68175be8a7b038e6da188a32394e10b2e86848c0227c9f0246201308deb2481878721937e09d7ab65a74a7f132bc56c8198a464f

  • SSDEEP

    24576:iyq+oxpgkWj+wPwGmtNCFo337H3QBadDUT8d3/DOwVLhiPujB:Jew9j+YwGmt2O7HHRs4/DOnPuj

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      af37016bed7a28ab28ed038685f75a7d6536b6acb0161e0ff49b89c080d03019.bin

    • Size

      1.1MB

    • MD5

      0c308c9934aa87cb5f53b8eeb67e2172

    • SHA1

      e60f090cc2de04bdb0f941ee71f91acce0687e16

    • SHA256

      af37016bed7a28ab28ed038685f75a7d6536b6acb0161e0ff49b89c080d03019

    • SHA512

      c12f5c9480790b0416ad100f68175be8a7b038e6da188a32394e10b2e86848c0227c9f0246201308deb2481878721937e09d7ab65a74a7f132bc56c8198a464f

    • SSDEEP

      24576:iyq+oxpgkWj+wPwGmtNCFo337H3QBadDUT8d3/DOwVLhiPujB:Jew9j+YwGmt2O7HHRs4/DOnPuj

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks