Overview

overview

10

Static

static

3

b4dd2a53a6...a3.exe

windows7-x64

10

b4dd2a53a6...a3.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b4dd2a53a66f438aec9efafb4b58c25c840822c28d0c353a7f27b7a76eb7aca3.bin

  • Size

    563KB

  • Sample

    230505-xs32msac4v

  • MD5

    49f11af18c349a684197f88a5ab96e3e

  • SHA1

    7b5e9df5010947da1c501251795dd61401f96a54

  • SHA256

    b4dd2a53a66f438aec9efafb4b58c25c840822c28d0c353a7f27b7a76eb7aca3

  • SHA512

    41b992c3a965c980d1466d74fceaabf57cce178fd5f2bd4a87e2f3113f7d62bd6b0b3a43a33f39223873bf0bf857d8f025d5e356e4f2eb8e9ded8eb2835c2c55

  • SSDEEP

    12288:Ky90V5p22u207aKnU6oNvElIsXzG0j06nMsA1kiqPQ8YJV1r:KyEoVNF5o2NDxj0GvAeifPV1r

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      b4dd2a53a66f438aec9efafb4b58c25c840822c28d0c353a7f27b7a76eb7aca3.bin

    • Size

      563KB

    • MD5

      49f11af18c349a684197f88a5ab96e3e

    • SHA1

      7b5e9df5010947da1c501251795dd61401f96a54

    • SHA256

      b4dd2a53a66f438aec9efafb4b58c25c840822c28d0c353a7f27b7a76eb7aca3

    • SHA512

      41b992c3a965c980d1466d74fceaabf57cce178fd5f2bd4a87e2f3113f7d62bd6b0b3a43a33f39223873bf0bf857d8f025d5e356e4f2eb8e9ded8eb2835c2c55

    • SSDEEP

      12288:Ky90V5p22u207aKnU6oNvElIsXzG0j06nMsA1kiqPQ8YJV1r:KyEoVNF5o2NDxj0GvAeifPV1r

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks