General

  • Target

    6653e65b8fae1209ac68b409304e909872790d8d6f065642695e902c3f10c8a7.bin

  • Size

    563KB

  • Sample

    230506-17vwcsde5v

  • MD5

    a4cf2f9da373bd7e6848450658a63a4c

  • SHA1

    960e9e70797029454aea92d7f34e248447fa9bb9

  • SHA256

    6653e65b8fae1209ac68b409304e909872790d8d6f065642695e902c3f10c8a7

  • SHA512

    2e79b62e836f6c93ddb116fa737f19e1943ccddb62e42f6ff92b7030b586f45842176c19edebe907e3fe660cb608ffb42c53813486247251a655a5e73f0b23e5

  • SSDEEP

    12288:Ry908wJpw11whEFUmslIhzzq0tnzwMGDO0tPodb1rJ++:RyCJ+6mF5N/ltn0FDVdY1rJn

Malware Config

Targets

    • Target

      6653e65b8fae1209ac68b409304e909872790d8d6f065642695e902c3f10c8a7.bin

    • Size

      563KB

    • MD5

      a4cf2f9da373bd7e6848450658a63a4c

    • SHA1

      960e9e70797029454aea92d7f34e248447fa9bb9

    • SHA256

      6653e65b8fae1209ac68b409304e909872790d8d6f065642695e902c3f10c8a7

    • SHA512

      2e79b62e836f6c93ddb116fa737f19e1943ccddb62e42f6ff92b7030b586f45842176c19edebe907e3fe660cb608ffb42c53813486247251a655a5e73f0b23e5

    • SSDEEP

      12288:Ry908wJpw11whEFUmslIhzzq0tnzwMGDO0tPodb1rJ++:RyCJ+6mF5N/ltn0FDVdY1rJn

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks