Overview

overview

10

Static

static

3

dd08112ba8...0d.exe

windows7-x64

10

dd08112ba8...0d.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    dd08112ba8942c14db848019368ed40d.exe.bin

  • Size

    696KB

  • Sample

    230505-yq81jsdd7x

  • MD5

    dd08112ba8942c14db848019368ed40d

  • SHA1

    2db5fdb287e16201a4d7612e5593acffff0a0848

  • SHA256

    101e6d28a5cb1216e2700a4236cb81df4a7e422e404c80bfb86462bdfef78ba9

  • SHA512

    7287a333f257190d4b1d1948671fbb3d76051209fce222d46d137bbac38f650ae2251f945415234cd8b1ce64e7f14b3a9529664887ec2c8fa293b60a9337cb6c

  • SSDEEP

    12288:ty904sMhGxdVU0uugGGx/qsvi8NU15z/kkxW6Yn0:tyi9wNDBqs68Ni5z/kK/Yn0

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      dd08112ba8942c14db848019368ed40d.exe.bin

    • Size

      696KB

    • MD5

      dd08112ba8942c14db848019368ed40d

    • SHA1

      2db5fdb287e16201a4d7612e5593acffff0a0848

    • SHA256

      101e6d28a5cb1216e2700a4236cb81df4a7e422e404c80bfb86462bdfef78ba9

    • SHA512

      7287a333f257190d4b1d1948671fbb3d76051209fce222d46d137bbac38f650ae2251f945415234cd8b1ce64e7f14b3a9529664887ec2c8fa293b60a9337cb6c

    • SSDEEP

      12288:ty904sMhGxdVU0uugGGx/qsvi8NU15z/kkxW6Yn0:tyi9wNDBqs68Ni5z/kK/Yn0

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks