redline

General

Target

e4ebf5ad851f44c07da339e58f403d333afa289fac492a737f9a316d15ebef4b
Size

1.5MB
Sample

230505-yykmxsbh69
MD5

b5e97e44c3593c9855807b202c040b4e
SHA1

6f863d326891556d49c5eb16452e746526a34367
SHA256

e4ebf5ad851f44c07da339e58f403d333afa289fac492a737f9a316d15ebef4b
SHA512

6f7009f755cbcdfb979cd924b58a448440ebe1a7571d066970125dce04c5b857c93ca4763ae563d6791aa7d48444c6202c5101480870ed44508c9287b9c22273
SSDEEP

24576:8y8GWYtGx4/jodmB3WHIQvh2DAPJDcYYoOFuM7ntCQYa+dy6CQw:r8dcGx4LodmkL52DAPINpCQYaX6C

Score

10^/10

Malware Config

Targets

- Target
  
  e4ebf5ad851f44c07da339e58f403d333afa289fac492a737f9a316d15ebef4b
- Size
  
  1.5MB
- MD5
  
  b5e97e44c3593c9855807b202c040b4e
- SHA1
  
  6f863d326891556d49c5eb16452e746526a34367
- SHA256
  
  e4ebf5ad851f44c07da339e58f403d333afa289fac492a737f9a316d15ebef4b
- SHA512
  
  6f7009f755cbcdfb979cd924b58a448440ebe1a7571d066970125dce04c5b857c93ca4763ae563d6791aa7d48444c6202c5101480870ed44508c9287b9c22273
- SSDEEP
  
  24576:8y8GWYtGx4/jodmB3WHIQvh2DAPJDcYYoOFuM7ntCQYa+dy6CQw:r8dcGx4LodmkL52DAPINpCQYaX6C
Score

10^/10

discovery evasion persistence spyware stealer trojan redline infostealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2