Overview

overview

10

Static

static

3

d8e9e8d82d...d4.exe

windows7-x64

10

d8e9e8d82d...d4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d8e9e8d82d1417b2f6c6f7cf0a5f9e4c37fd92ab70e0a3216b70b3180dae60d4.bin

  • Size

    990KB

  • Sample

    230505-ymwaaadb2v

  • MD5

    7b545ccf1eee36e2f0133f4ed53c01f7

  • SHA1

    ecc69294da34f4641b1ea506d22b107932244569

  • SHA256

    d8e9e8d82d1417b2f6c6f7cf0a5f9e4c37fd92ab70e0a3216b70b3180dae60d4

  • SHA512

    2e39a8019709f4a629254f99ec76915cc00578111bb178bf1f4ece6f9b8f7a4ab91292e1b418c035d399765a68d106197e26cce70ecc192f29b9544c9260041c

  • SSDEEP

    24576:+nUoY7pfy8Yg7Q7TsRZcKeD2Mzlnk+IY8Mlf:R7By87STskKefd5

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      d8e9e8d82d1417b2f6c6f7cf0a5f9e4c37fd92ab70e0a3216b70b3180dae60d4.bin

    • Size

      990KB

    • MD5

      7b545ccf1eee36e2f0133f4ed53c01f7

    • SHA1

      ecc69294da34f4641b1ea506d22b107932244569

    • SHA256

      d8e9e8d82d1417b2f6c6f7cf0a5f9e4c37fd92ab70e0a3216b70b3180dae60d4

    • SHA512

      2e39a8019709f4a629254f99ec76915cc00578111bb178bf1f4ece6f9b8f7a4ab91292e1b418c035d399765a68d106197e26cce70ecc192f29b9544c9260041c

    • SSDEEP

      24576:+nUoY7pfy8Yg7Q7TsRZcKeD2Mzlnk+IY8Mlf:R7By87STskKefd5

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks