redline | d1051a6e5813ae8faf78b2248f8f81592f08f8f996507fe0b322c21f5a92a84f | Triage

Submit
Reports

Overview

overview

Static

static

3

d1051a6e58...4f.exe

windows7-x64

d1051a6e58...4f.exe

windows10-2004-x64

Resubmissions

29-10-2024 10:37

241029-mnv55avbqk 10

05-05-2023 19:46

230505-yg72wscd81 10

Sharing

General

Target

d1051a6e5813ae8faf78b2248f8f81592f08f8f996507fe0b322c21f5a92a84f.bin
Size

1.2MB
Sample

230505-yg72wscd81
MD5

74b0ccf3de68e8e63088a697bccced26
SHA1

d3d8252558125ac843ac3c339bab3641e23a61d5
SHA256

d1051a6e5813ae8faf78b2248f8f81592f08f8f996507fe0b322c21f5a92a84f
SHA512

85de1d6d8b4ec19a3b82ecbbd41ce129742c63fd306214bb37c3005733056a7cab7c5a3765c41612a00d5e12c694f11864146e69fb723d696ce18a50caec74c9
SSDEEP

24576:LyfKfMXMQEseAkUF4Owq7/nqC0fIXSV8UQRBQfU3LEI:+fwMc5PCF4OhPqC0fzQLQfOL

Score

10^/10

redline evasion infostealer persistence stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

d1051a6e5813ae8faf78b2248f8f81592f08f8f996507fe0b322c21f5a92a84f.exe

Resource

win7-20230220-en

evasion persistence trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

d1051a6e5813ae8faf78b2248f8f81592f08f8f996507fe0b322c21f5a92a84f.exe

Resource

win10v2004-20230220-en

redline evasion infostealer persistence stealer trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  d1051a6e5813ae8faf78b2248f8f81592f08f8f996507fe0b322c21f5a92a84f.bin
- Size
  
  1.2MB
- MD5
  
  74b0ccf3de68e8e63088a697bccced26
- SHA1
  
  d3d8252558125ac843ac3c339bab3641e23a61d5
- SHA256
  
  d1051a6e5813ae8faf78b2248f8f81592f08f8f996507fe0b322c21f5a92a84f
- SHA512
  
  85de1d6d8b4ec19a3b82ecbbd41ce129742c63fd306214bb37c3005733056a7cab7c5a3765c41612a00d5e12c694f11864146e69fb723d696ce18a50caec74c9
- SSDEEP
  
  24576:LyfKfMXMQEseAkUF4Owq7/nqC0fIXSV8UQRBQfU3LEI:+fwMc5PCF4OhPqC0fzQLQfOL
Score

10^/10

evasion persistence trojan redline infostealer stealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

redlineevasioninfostealerpersistencestealertrojan

© 2018-2025

Terms | Privacy