Overview

overview

10

Static

static

3

5dc6b7d048...d8.exe

windows7-x64

10

5dc6b7d048...d8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5dc6b7d048f9f19ffc0b20e6525b476bf0df92c45d90a3e4025704a3d6c91fd8.bin

  • Size

    1.2MB

  • Sample

    230506-12ay1aba22

  • MD5

    09750411b737411d9d711582bc29bef7

  • SHA1

    ccde94708b58fef4d6c53c021aa6c20cf0704ac5

  • SHA256

    5dc6b7d048f9f19ffc0b20e6525b476bf0df92c45d90a3e4025704a3d6c91fd8

  • SHA512

    a769d76339a26ddcdc298e1242d844f193c0f353a4dfdc223dbe0995520f28e6c4ec0823742ecb1197a670be7ad0d8edbc08a285ddf02a1fb4ad32ac3c34afa1

  • SSDEEP

    24576:Xu0fRlKB2ZGPoUC1VqAUjfeEB7htX0yromAWB5HpS/gl:e0+BshUC1VzUjjPP0/

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      5dc6b7d048f9f19ffc0b20e6525b476bf0df92c45d90a3e4025704a3d6c91fd8.bin

    • Size

      1.2MB

    • MD5

      09750411b737411d9d711582bc29bef7

    • SHA1

      ccde94708b58fef4d6c53c021aa6c20cf0704ac5

    • SHA256

      5dc6b7d048f9f19ffc0b20e6525b476bf0df92c45d90a3e4025704a3d6c91fd8

    • SHA512

      a769d76339a26ddcdc298e1242d844f193c0f353a4dfdc223dbe0995520f28e6c4ec0823742ecb1197a670be7ad0d8edbc08a285ddf02a1fb4ad32ac3c34afa1

    • SSDEEP

      24576:Xu0fRlKB2ZGPoUC1VqAUjfeEB7htX0yromAWB5HpS/gl:e0+BshUC1VzUjjPP0/

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks