redline

General

Target

ca887dd704d9e5cff862551bf30e25e40ce8e0d1cc6a59b7efd99984f5b68ecd
Size

709KB
Sample

230505-ya2ljabh7t
MD5

32c439d81b4c78400821415a00b724af
SHA1

4181ec36934778bc462d822b6e30e0acaaafc6d9
SHA256

ca887dd704d9e5cff862551bf30e25e40ce8e0d1cc6a59b7efd99984f5b68ecd
SHA512

77dd6a5f5648e4ae1d92f3e4e22b4fdf552c975cbf41fc39a25b0458f7261683478ef3b832c5867c70eaf5898f3b405599c0aee6f657d66389ba0738be30f257
SSDEEP

12288:pMrcy9050+tfM4ZlcprWOCH/ule0xwNYWiSK75TA/VaUyCaWWsAfcJT:dyInRMlprWOCfule0+NYWiSWANSCVW0V

Score

10^/10

Malware Config

Targets

- Target
  
  ca887dd704d9e5cff862551bf30e25e40ce8e0d1cc6a59b7efd99984f5b68ecd
- Size
  
  709KB
- MD5
  
  32c439d81b4c78400821415a00b724af
- SHA1
  
  4181ec36934778bc462d822b6e30e0acaaafc6d9
- SHA256
  
  ca887dd704d9e5cff862551bf30e25e40ce8e0d1cc6a59b7efd99984f5b68ecd
- SHA512
  
  77dd6a5f5648e4ae1d92f3e4e22b4fdf552c975cbf41fc39a25b0458f7261683478ef3b832c5867c70eaf5898f3b405599c0aee6f657d66389ba0738be30f257
- SSDEEP
  
  12288:pMrcy9050+tfM4ZlcprWOCH/ule0xwNYWiSK75TA/VaUyCaWWsAfcJT:dyInRMlprWOCfule0+NYWiSWANSCVW0V
Score

10^/10

discovery evasion persistence spyware stealer trojan redline infostealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2