Overview

overview

10

Static

static

3

606fc8ea04...d5.exe

windows7-x64

10

606fc8ea04...d5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    606fc8ea0483ac84f641de8110c16e1ab30f2af36683634355850149af9137d5.bin

  • Size

    746KB

  • Sample

    230506-13w8mabb74

  • MD5

    8aef720475daeb05576c846798edb278

  • SHA1

    830fe0ae819e5dea23f04e0f8c026aa65bd6939a

  • SHA256

    606fc8ea0483ac84f641de8110c16e1ab30f2af36683634355850149af9137d5

  • SHA512

    89fab0043445270482839d7cec4401ee201319155741569067a4561ac3e291ed582265791dfdd56731f5467249c963c15468db0ab5143f59239f4892e4617315

  • SSDEEP

    12288:2y90qJnf20pMjHRfhoxxU0jEViG6PQ9UqBt/XtYL+Fh5:2yt6HRJkxG0K/XmkX

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      606fc8ea0483ac84f641de8110c16e1ab30f2af36683634355850149af9137d5.bin

    • Size

      746KB

    • MD5

      8aef720475daeb05576c846798edb278

    • SHA1

      830fe0ae819e5dea23f04e0f8c026aa65bd6939a

    • SHA256

      606fc8ea0483ac84f641de8110c16e1ab30f2af36683634355850149af9137d5

    • SHA512

      89fab0043445270482839d7cec4401ee201319155741569067a4561ac3e291ed582265791dfdd56731f5467249c963c15468db0ab5143f59239f4892e4617315

    • SSDEEP

      12288:2y90qJnf20pMjHRfhoxxU0jEViG6PQ9UqBt/XtYL+Fh5:2yt6HRJkxG0K/XmkX

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks