Overview

overview

10

Static

static

3

f8d591a956...db.exe

windows7-x64

10

f8d591a956...db.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f8d591a95693594269c15824d84b1461ddaae4241ed077c8549a3fea3ee897db.bin

  • Size

    1.1MB

  • Sample

    230505-zccwmaff5x

  • MD5

    49de4bdfc8f521b46dd15c2eb2f3e8f9

  • SHA1

    24feaba0d4f6805146f527374375bdddf713d586

  • SHA256

    f8d591a95693594269c15824d84b1461ddaae4241ed077c8549a3fea3ee897db

  • SHA512

    cf169cfa65eb75a2fa8c53cc05d920dae0c159bcf1c147eac081e40065537f8870efe3c49dc6b7aa03e92997114e474ee5731accfbfbed822e85e0186bac1661

  • SSDEEP

    12288:0y907RV4orRK/wdbHAfBWQkZwgGCbtJkZ6BwkiHeSlGBL1VT4bmCvD57ZwWL6FaZ:0y24t4x2fpRWDCiT4tl9V6FaO8bAh1Q

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      f8d591a95693594269c15824d84b1461ddaae4241ed077c8549a3fea3ee897db.bin

    • Size

      1.1MB

    • MD5

      49de4bdfc8f521b46dd15c2eb2f3e8f9

    • SHA1

      24feaba0d4f6805146f527374375bdddf713d586

    • SHA256

      f8d591a95693594269c15824d84b1461ddaae4241ed077c8549a3fea3ee897db

    • SHA512

      cf169cfa65eb75a2fa8c53cc05d920dae0c159bcf1c147eac081e40065537f8870efe3c49dc6b7aa03e92997114e474ee5731accfbfbed822e85e0186bac1661

    • SSDEEP

      12288:0y907RV4orRK/wdbHAfBWQkZwgGCbtJkZ6BwkiHeSlGBL1VT4bmCvD57ZwWL6FaZ:0y24t4x2fpRWDCiT4tl9V6FaO8bAh1Q

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks