Overview

overview

10

Static

static

3

6795105642...5f.exe

windows7-x64

10

6795105642...5f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    67951056421c50d2532dc8a18406dc603a23a2ba6bc52cc1f80400ac1af0615f.bin

  • Size

    563KB

  • Sample

    230506-18lzvabh46

  • MD5

    2a56d4dc574313429b8cc406dfb1738a

  • SHA1

    ceee502b7f7d07cbe284af29f42ecfa43cbb04c1

  • SHA256

    67951056421c50d2532dc8a18406dc603a23a2ba6bc52cc1f80400ac1af0615f

  • SHA512

    60397aed026b96183ff36fa3440b36af3472552f7354b61e194cd3ac7599f85203fbb95c76909bbd1c7d5212520301274ca3997ee6e06f55dc5c2ee4a0e7403d

  • SSDEEP

    12288:ry90pBO5K98HT96/eyZvI0szd0mOz0M3qOW5L6jG:rykBOKLeyJ4WmOg4CAjG

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      67951056421c50d2532dc8a18406dc603a23a2ba6bc52cc1f80400ac1af0615f.bin

    • Size

      563KB

    • MD5

      2a56d4dc574313429b8cc406dfb1738a

    • SHA1

      ceee502b7f7d07cbe284af29f42ecfa43cbb04c1

    • SHA256

      67951056421c50d2532dc8a18406dc603a23a2ba6bc52cc1f80400ac1af0615f

    • SHA512

      60397aed026b96183ff36fa3440b36af3472552f7354b61e194cd3ac7599f85203fbb95c76909bbd1c7d5212520301274ca3997ee6e06f55dc5c2ee4a0e7403d

    • SSDEEP

      12288:ry90pBO5K98HT96/eyZvI0szd0mOz0M3qOW5L6jG:rykBOKLeyJ4WmOg4CAjG

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks