Overview

overview

10

Static

static

3

ce65a9e3d5...12.exe

windows7-x64

10

ce65a9e3d5...12.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ce65a9e3d5518352a74aae93dd286c8b0e46597ffd62c0764d4d36fe4f86b412.bin

  • Size

    1.2MB

  • Sample

    230505-yebkxacb9y

  • MD5

    291c68e8ece6a304af62e92ebe41ce28

  • SHA1

    fa0e553ae96f779e8776660c786f26392d162a33

  • SHA256

    ce65a9e3d5518352a74aae93dd286c8b0e46597ffd62c0764d4d36fe4f86b412

  • SHA512

    1cc222e18376f79038875a65f035a312a35983cdfa4e19dbc9a2b4f80481f1b4901d14358c659e6dd05872f77b409e3a68dbe7285dfa85920f0d465a7412153c

  • SSDEEP

    24576:iO/ma41pNBrquMHuDpKqJUd5xYsLo11YdH/tFrQhldU8HJVYx+dblqaWSLO:iOXedEODpKqJGYsLMutFEIx257

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      ce65a9e3d5518352a74aae93dd286c8b0e46597ffd62c0764d4d36fe4f86b412.bin

    • Size

      1.2MB

    • MD5

      291c68e8ece6a304af62e92ebe41ce28

    • SHA1

      fa0e553ae96f779e8776660c786f26392d162a33

    • SHA256

      ce65a9e3d5518352a74aae93dd286c8b0e46597ffd62c0764d4d36fe4f86b412

    • SHA512

      1cc222e18376f79038875a65f035a312a35983cdfa4e19dbc9a2b4f80481f1b4901d14358c659e6dd05872f77b409e3a68dbe7285dfa85920f0d465a7412153c

    • SSDEEP

      24576:iO/ma41pNBrquMHuDpKqJUd5xYsLo11YdH/tFrQhldU8HJVYx+dblqaWSLO:iOXedEODpKqJGYsLMutFEIx257

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks