Overview

overview

10

Static

static

3

d2d1d8f55a...a8.exe

windows7-x64

10

d2d1d8f55a...a8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d2d1d8f55aca9b3ba0ad5675174765fb3e7280f0c37971bfdb29186e537c2ea8.bin

  • Size

    1.1MB

  • Sample

    230505-yjbfpsce9x

  • MD5

    a0c1058cfcf738b2b40daa005c50ef51

  • SHA1

    b4f2f3702aa432729a94655c51db13f541f97f95

  • SHA256

    d2d1d8f55aca9b3ba0ad5675174765fb3e7280f0c37971bfdb29186e537c2ea8

  • SHA512

    83f2d20845797cd0d91049f7863713b28b3e547f401c53869303df27dc935b59d0f080fa13498c8bbb3b39630671353e1f53f3c920a4cbd4da48f5829c46e753

  • SSDEEP

    12288:Ny90EnMzEH0W9prs5UzKoJ/W9BwTJZAxP57wiiIZwgY6dIgMht1WM6F2i8bOKUA/:NyrT9R4oA2qPtL8Xhf6F2i8bOrQkiiG

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      d2d1d8f55aca9b3ba0ad5675174765fb3e7280f0c37971bfdb29186e537c2ea8.bin

    • Size

      1.1MB

    • MD5

      a0c1058cfcf738b2b40daa005c50ef51

    • SHA1

      b4f2f3702aa432729a94655c51db13f541f97f95

    • SHA256

      d2d1d8f55aca9b3ba0ad5675174765fb3e7280f0c37971bfdb29186e537c2ea8

    • SHA512

      83f2d20845797cd0d91049f7863713b28b3e547f401c53869303df27dc935b59d0f080fa13498c8bbb3b39630671353e1f53f3c920a4cbd4da48f5829c46e753

    • SSDEEP

      12288:Ny90EnMzEH0W9prs5UzKoJ/W9BwTJZAxP57wiiIZwgY6dIgMht1WM6F2i8bOKUA/:NyrT9R4oA2qPtL8Xhf6F2i8bOrQkiiG

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks