Overview

overview

10

Static

static

3

f7f43a5c02...14.exe

windows7-x64

10

f7f43a5c02...14.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f7f43a5c02d89f874ede1f2e2e19c697dff142d23ce91760509ae0e5121c0614.bin

  • Size

    1.2MB

  • Sample

    230505-zbvp2sfe9w

  • MD5

    3453c5e378a135f8b38fb2a502235ff0

  • SHA1

    420b3cc1e629ae613f5a3e1d646b1fd32e113090

  • SHA256

    f7f43a5c02d89f874ede1f2e2e19c697dff142d23ce91760509ae0e5121c0614

  • SHA512

    edb39ef9f59c258bc3564060c2c3668ef120abe36df4a94b36e20da55bbb434590a2332fedf013e641c1b1a9b84016a1432375c51cbb9be3c1342e837d451963

  • SSDEEP

    24576:Ej3DX6L44JAoqyf2Bh1F/tSs8mL2U7wucjiw017bw1xq9poyMmem:Ej76L+oqyf2Bl/ksdr754iw017bmw

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      f7f43a5c02d89f874ede1f2e2e19c697dff142d23ce91760509ae0e5121c0614.bin

    • Size

      1.2MB

    • MD5

      3453c5e378a135f8b38fb2a502235ff0

    • SHA1

      420b3cc1e629ae613f5a3e1d646b1fd32e113090

    • SHA256

      f7f43a5c02d89f874ede1f2e2e19c697dff142d23ce91760509ae0e5121c0614

    • SHA512

      edb39ef9f59c258bc3564060c2c3668ef120abe36df4a94b36e20da55bbb434590a2332fedf013e641c1b1a9b84016a1432375c51cbb9be3c1342e837d451963

    • SSDEEP

      24576:Ej3DX6L44JAoqyf2Bh1F/tSs8mL2U7wucjiw017bw1xq9poyMmem:Ej76L+oqyf2Bl/ksdr754iw017bmw

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks