Overview

overview

10

Static

static

3

edb275e7bf...ec.exe

windows7-x64

10

edb275e7bf...ec.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    edb275e7bfa22c8f60a69accbac7a1cce5e97f09ed810478bb4b0452a5c331ec.bin

  • Size

    1.1MB

  • Sample

    230505-y5zenacf29

  • MD5

    e5803e9c8b51897a264c7904da16f7ae

  • SHA1

    c6f48ccddbf8d2cc5c1a505d31be06f8a5a5430f

  • SHA256

    edb275e7bfa22c8f60a69accbac7a1cce5e97f09ed810478bb4b0452a5c331ec

  • SHA512

    46fdcf0bb222eacc614430f2283bc699b1061412d31af75581bc88c92ff9d79c91c1d77a13de4e182a67603641ba1a3dfd5d05ce2a6a9c695215293077f7b005

  • SSDEEP

    24576:Mypabv9Ei+PgZ1G7COplQZmJWqu4hC0SolKkZ18hgjlWgEm3:7pablEbWsOOz+mJWCCB8K83jt

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      edb275e7bfa22c8f60a69accbac7a1cce5e97f09ed810478bb4b0452a5c331ec.bin

    • Size

      1.1MB

    • MD5

      e5803e9c8b51897a264c7904da16f7ae

    • SHA1

      c6f48ccddbf8d2cc5c1a505d31be06f8a5a5430f

    • SHA256

      edb275e7bfa22c8f60a69accbac7a1cce5e97f09ed810478bb4b0452a5c331ec

    • SHA512

      46fdcf0bb222eacc614430f2283bc699b1061412d31af75581bc88c92ff9d79c91c1d77a13de4e182a67603641ba1a3dfd5d05ce2a6a9c695215293077f7b005

    • SSDEEP

      24576:Mypabv9Ei+PgZ1G7COplQZmJWqu4hC0SolKkZ18hgjlWgEm3:7pablEbWsOOz+mJWCCB8K83jt

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks