Overview

overview

10

Static

static

3

eecb9f2d44...cf.exe

windows7-x64

10

eecb9f2d44...cf.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    eecb9f2d44b7abefbdaf0ccfeddfb0509e8172bcddd1bf3ecefb9068bfeadacf.bin

  • Size

    1.1MB

  • Sample

    230505-y6k9eseh5s

  • MD5

    13b46400e4db93254a8f13b5fa258524

  • SHA1

    cb1bea5212fb21537781c7d8095956a922962522

  • SHA256

    eecb9f2d44b7abefbdaf0ccfeddfb0509e8172bcddd1bf3ecefb9068bfeadacf

  • SHA512

    afb6f2c04b036f8881f874ea431f0f5ed4d1c54cc36d525834a59ae95d934198c37bf7206c3a452ae5b711f6228c7abe1893642e6b4c99cc4f7212ed57e2392d

  • SSDEEP

    24576:Yyu99GK8/hZm1PrgtgWxquBvMvB0vqNqJnkuL2pgSHx+F8f:fuGK877tTBGB1qSuL5SRr

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      eecb9f2d44b7abefbdaf0ccfeddfb0509e8172bcddd1bf3ecefb9068bfeadacf.bin

    • Size

      1.1MB

    • MD5

      13b46400e4db93254a8f13b5fa258524

    • SHA1

      cb1bea5212fb21537781c7d8095956a922962522

    • SHA256

      eecb9f2d44b7abefbdaf0ccfeddfb0509e8172bcddd1bf3ecefb9068bfeadacf

    • SHA512

      afb6f2c04b036f8881f874ea431f0f5ed4d1c54cc36d525834a59ae95d934198c37bf7206c3a452ae5b711f6228c7abe1893642e6b4c99cc4f7212ed57e2392d

    • SSDEEP

      24576:Yyu99GK8/hZm1PrgtgWxquBvMvB0vqNqJnkuL2pgSHx+F8f:fuGK877tTBGB1qSuL5SRr

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks