Overview

overview

10

Static

static

3

e2837b43ae...0b.exe

windows7-x64

10

e2837b43ae...0b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e2837b43ae222045da6968fc91c4ca3dd49a2134b5f924688d5d43cb90dbb90b.bin

  • Size

    1.1MB

  • Sample

    230505-yw32gsdh51

  • MD5

    44ac65128bf79a76c7ef867d56bb7518

  • SHA1

    06f0acbd48acce7f1a645ddffd284d2649bef8d3

  • SHA256

    e2837b43ae222045da6968fc91c4ca3dd49a2134b5f924688d5d43cb90dbb90b

  • SHA512

    3046d12658e08ac3b8625849ab44ea6ae8e8da6bf67dca060af6836b421db6d9fedd965ad4ed591c229b32e924dc20701cf9d6d68c980887196e6a5824440ec9

  • SSDEEP

    24576:/yVL7yhnORGsx+4LJLjnXTSHvcAOkYP8KoT9quYjnDmeECGo33:KF7oAY4LJLjXTSUAmP3oRqTjnyq

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      e2837b43ae222045da6968fc91c4ca3dd49a2134b5f924688d5d43cb90dbb90b.bin

    • Size

      1.1MB

    • MD5

      44ac65128bf79a76c7ef867d56bb7518

    • SHA1

      06f0acbd48acce7f1a645ddffd284d2649bef8d3

    • SHA256

      e2837b43ae222045da6968fc91c4ca3dd49a2134b5f924688d5d43cb90dbb90b

    • SHA512

      3046d12658e08ac3b8625849ab44ea6ae8e8da6bf67dca060af6836b421db6d9fedd965ad4ed591c229b32e924dc20701cf9d6d68c980887196e6a5824440ec9

    • SSDEEP

      24576:/yVL7yhnORGsx+4LJLjnXTSHvcAOkYP8KoT9quYjnDmeECGo33:KF7oAY4LJLjXTSUAmP3oRqTjnyq

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks