redline | 6960d843f1b47db7aa8e3b46cff8d727229559383285bc37ccf50497a7297f9f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6960d843f1b47db7aa8e3b46cff8d727229559383285bc37ccf50497a7297f9f
Size

376KB
Sample

230506-19wwfadg61
MD5

fee5d8de36086d28eb03276a1978abdc
SHA1

54f80385cf49e04c2342355dd61f2847fb2fa835
SHA256

6960d843f1b47db7aa8e3b46cff8d727229559383285bc37ccf50497a7297f9f
SHA512

db189ff85fee462fad7eccbaaa471567cf5b6621ae5258afc7d7afbaddb3874abc90b4179305617ddd9e53112724495fbf73ec63f6ead0f307dfc0c6b092a8ee
SSDEEP

6144:KCy+bnr+cp0yN90QE0wPQy7RkLafdkp4DljuVKG0Ml3s17It/YLzCdGpvnn5bXYV:OMroy902wPzl2aC4DljhMI7I1Uuen57+

Score

10^/10

redline evasion infostealer persistence stealer trojan

Malware Config

Targets

- Target
  
  6960d843f1b47db7aa8e3b46cff8d727229559383285bc37ccf50497a7297f9f
- Size
  
  376KB
- MD5
  
  fee5d8de36086d28eb03276a1978abdc
- SHA1
  
  54f80385cf49e04c2342355dd61f2847fb2fa835
- SHA256
  
  6960d843f1b47db7aa8e3b46cff8d727229559383285bc37ccf50497a7297f9f
- SHA512
  
  db189ff85fee462fad7eccbaaa471567cf5b6621ae5258afc7d7afbaddb3874abc90b4179305617ddd9e53112724495fbf73ec63f6ead0f307dfc0c6b092a8ee
- SSDEEP
  
  6144:KCy+bnr+cp0yN90QE0wPQy7RkLafdkp4DljuVKG0Ml3s17It/YLzCdGpvnn5bXYV:OMroy902wPzl2aC4DljhMI7I1Uuen57+
Score

10^/10

evasion persistence trojan redline infostealer stealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

redlineevasioninfostealerpersistencestealertrojan