General

  • Target

    699a3134a85a00271055d62fb6fe090b7f4f152443944162f3cdeebcce438ba4.bin

  • Size

    690KB

  • Sample

    230506-192fxsca76

  • MD5

    035392bf4ae58f8b9420a185ab974db5

  • SHA1

    b605679ce877a6f0278fde3a35aa056a70b4d3ab

  • SHA256

    699a3134a85a00271055d62fb6fe090b7f4f152443944162f3cdeebcce438ba4

  • SHA512

    cc6940c222443ae1aed2ac10577fce5bc5eb756162b5c1e45d5e36f9ca6cc67b45c2f2418a6646482b5203cefef1950713b2f99db063b2a14ef21fba1f95195a

  • SSDEEP

    12288:/y90PP3tOtOc8j4vVdUXd0vISy0sB/2mmsP4DAhHtipS:/yY3I4uV2Xd0vID12mpg8Htig

Malware Config

Targets

    • Target

      699a3134a85a00271055d62fb6fe090b7f4f152443944162f3cdeebcce438ba4.bin

    • Size

      690KB

    • MD5

      035392bf4ae58f8b9420a185ab974db5

    • SHA1

      b605679ce877a6f0278fde3a35aa056a70b4d3ab

    • SHA256

      699a3134a85a00271055d62fb6fe090b7f4f152443944162f3cdeebcce438ba4

    • SHA512

      cc6940c222443ae1aed2ac10577fce5bc5eb756162b5c1e45d5e36f9ca6cc67b45c2f2418a6646482b5203cefef1950713b2f99db063b2a14ef21fba1f95195a

    • SSDEEP

      12288:/y90PP3tOtOc8j4vVdUXd0vISy0sB/2mmsP4DAhHtipS:/yY3I4uV2Xd0vID12mpg8Htig

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks