Overview

overview

10

Static

static

3

cb2166ddc6...c0.exe

windows7-x64

10

cb2166ddc6...c0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    cb2166ddc688e2586b9251e4130a329f4e35cb6e67c1e2476c27f7ebdff730c0.bin

  • Size

    747KB

  • Sample

    230505-ybkpeaca31

  • MD5

    d924a55ec29e05f40aeb634c8161d5b7

  • SHA1

    7231e4bdd82d29695705e25b55ce897d07007fc0

  • SHA256

    cb2166ddc688e2586b9251e4130a329f4e35cb6e67c1e2476c27f7ebdff730c0

  • SHA512

    a90816dab3ba73bb9834a57a377748ae66be4a1a0ee292c8ef0a31d21ceeaf51d9fb72202edb7ddd86731a19480731c563863ca6069444a4d8316a98905f1342

  • SSDEEP

    12288:+y90Vhbh2NFxAnGn7kZO8f5xUhR32Dcj7skCCShYIifRrCNzHgcNr:+yy5h2HxA67p8fUb2Dc0DhpifNCf

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      cb2166ddc688e2586b9251e4130a329f4e35cb6e67c1e2476c27f7ebdff730c0.bin

    • Size

      747KB

    • MD5

      d924a55ec29e05f40aeb634c8161d5b7

    • SHA1

      7231e4bdd82d29695705e25b55ce897d07007fc0

    • SHA256

      cb2166ddc688e2586b9251e4130a329f4e35cb6e67c1e2476c27f7ebdff730c0

    • SHA512

      a90816dab3ba73bb9834a57a377748ae66be4a1a0ee292c8ef0a31d21ceeaf51d9fb72202edb7ddd86731a19480731c563863ca6069444a4d8316a98905f1342

    • SSDEEP

      12288:+y90Vhbh2NFxAnGn7kZO8f5xUhR32Dcj7skCCShYIifRrCNzHgcNr:+yy5h2HxA67p8fUb2Dc0DhpifNCf

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks