redline | b4eb6c5205f61088248ff6c7c0e93704567ef09116b0a9041206b4103e2c612c | Triage

Submit
Reports

Overview

overview

Static

static

3

b4eb6c5205...2c.exe

windows7-x64

b4eb6c5205...2c.exe

windows10-2004-x64

Sharing

General

Target

b4eb6c5205f61088248ff6c7c0e93704567ef09116b0a9041206b4103e2c612c.bin
Size

746KB
Sample

230505-xs6grsga93
MD5

878507b7ab5bc35ed3146b7eebb9908e
SHA1

a64c76f90686d929befb336bf8586e6c1c359c35
SHA256

b4eb6c5205f61088248ff6c7c0e93704567ef09116b0a9041206b4103e2c612c
SHA512

d8b0a7c2cce1c1f39671c3012bb76bde50b6860d75d7bca59fdbcfb042b9bf29bb830cca65bddab789cb2e6fd2da63ca1a0c4a3135416df2e95b4df467407db7
SSDEEP

12288:wy902vGIocOpE8oqvSrVR+KdB5C+bX6ZVB+5RZvI9YbNx9LmHk9D5WHfgiyH3J9b:wyocO1BvVKdvC+eZe5RoivxEcAfgnZtz

Score

10^/10

redline evasion infostealer persistence stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b4eb6c5205f61088248ff6c7c0e93704567ef09116b0a9041206b4103e2c612c.exe

Resource

win7-20230220-en

evasion persistence trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

b4eb6c5205f61088248ff6c7c0e93704567ef09116b0a9041206b4103e2c612c.exe

Resource

win10v2004-20230220-en

redline evasion infostealer persistence stealer trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  b4eb6c5205f61088248ff6c7c0e93704567ef09116b0a9041206b4103e2c612c.bin
- Size
  
  746KB
- MD5
  
  878507b7ab5bc35ed3146b7eebb9908e
- SHA1
  
  a64c76f90686d929befb336bf8586e6c1c359c35
- SHA256
  
  b4eb6c5205f61088248ff6c7c0e93704567ef09116b0a9041206b4103e2c612c
- SHA512
  
  d8b0a7c2cce1c1f39671c3012bb76bde50b6860d75d7bca59fdbcfb042b9bf29bb830cca65bddab789cb2e6fd2da63ca1a0c4a3135416df2e95b4df467407db7
- SSDEEP
  
  12288:wy902vGIocOpE8oqvSrVR+KdB5C+bX6ZVB+5RZvI9YbNx9LmHk9D5WHfgiyH3J9b:wyocO1BvVKdvC+eZe5RoivxEcAfgnZtz
Score

10^/10

evasion persistence trojan redline infostealer stealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

redlineevasioninfostealerpersistencestealertrojan

© 2018-2024

Terms | Privacy