Overview

overview

10

Static

static

3

b098929177...21.exe

windows7-x64

10

b098929177...21.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b098929177cd34424d85ccc71381025cf7fcdc4baf7ff5260e8fd28673d8f321.bin

  • Size

    1.1MB

  • Sample

    230505-xqabjsfg55

  • MD5

    92ec9e3d1e2e58d546907003cdb278f6

  • SHA1

    337d860221f068aac51e0d1ecfd9b60d35ed2562

  • SHA256

    b098929177cd34424d85ccc71381025cf7fcdc4baf7ff5260e8fd28673d8f321

  • SHA512

    d93866cb31322240eee0e9fe372b8249a808110c5a819572d161af90f1a7c0cef75753d511e0ad5ca21b3d38e4d5295d081b3f813c0e07195462c423c5027021

  • SSDEEP

    24576:Lym/vUkGTFqDh1yw3CSzPM1YCfa+6FBv8bdraz4Bt4:+m/vcIDffCSzPM+LFBEp2z

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      b098929177cd34424d85ccc71381025cf7fcdc4baf7ff5260e8fd28673d8f321.bin

    • Size

      1.1MB

    • MD5

      92ec9e3d1e2e58d546907003cdb278f6

    • SHA1

      337d860221f068aac51e0d1ecfd9b60d35ed2562

    • SHA256

      b098929177cd34424d85ccc71381025cf7fcdc4baf7ff5260e8fd28673d8f321

    • SHA512

      d93866cb31322240eee0e9fe372b8249a808110c5a819572d161af90f1a7c0cef75753d511e0ad5ca21b3d38e4d5295d081b3f813c0e07195462c423c5027021

    • SSDEEP

      24576:Lym/vUkGTFqDh1yw3CSzPM1YCfa+6FBv8bdraz4Bt4:+m/vcIDffCSzPM+LFBEp2z

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks