Overview

overview

10

Static

static

3

f331fb4116...ac.exe

windows7-x64

10

f331fb4116...ac.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f331fb41165e74e4e6954acc327d1b5d21d766399d658a095702d1d3afd3adac.bin

  • Size

    1.1MB

  • Sample

    230505-y9hmpsfc5t

  • MD5

    d2e1f2b627c08ae91c40da83cd5ff16a

  • SHA1

    d9ef703c1f2b021c5aadb668c88fd295bb6c4f7a

  • SHA256

    f331fb41165e74e4e6954acc327d1b5d21d766399d658a095702d1d3afd3adac

  • SHA512

    db8164d4ad9b1c056d8a67f448e98e22bac383720aef5b0cdb0c489b6803f8805601d51af62dcbb56be489e8bbd320684795373ecd3b47e8cf60298f5c444995

  • SSDEEP

    24576:CyW5FIbyNwkI4PgEfzPDjsjMLVulaObMECwSh5TrmiH:pWbIJ4P/bMj+rczCPh5TrB

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      f331fb41165e74e4e6954acc327d1b5d21d766399d658a095702d1d3afd3adac.bin

    • Size

      1.1MB

    • MD5

      d2e1f2b627c08ae91c40da83cd5ff16a

    • SHA1

      d9ef703c1f2b021c5aadb668c88fd295bb6c4f7a

    • SHA256

      f331fb41165e74e4e6954acc327d1b5d21d766399d658a095702d1d3afd3adac

    • SHA512

      db8164d4ad9b1c056d8a67f448e98e22bac383720aef5b0cdb0c489b6803f8805601d51af62dcbb56be489e8bbd320684795373ecd3b47e8cf60298f5c444995

    • SSDEEP

      24576:CyW5FIbyNwkI4PgEfzPDjsjMLVulaObMECwSh5TrmiH:pWbIJ4P/bMj+rczCPh5TrB

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks