Overview

overview

10

Static

static

3

697326b7c0...70.exe

windows7-x64

10

697326b7c0...70.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    697326b7c02af7d4e12984089d0f9e2b2ff4d8ebad8ea1ce62924958f43aeb70.bin

  • Size

    1.1MB

  • Sample

    230506-19yp2adg7w

  • MD5

    87346f5dcbace2e71c85fdddb95da233

  • SHA1

    7887056965a41c17f6982ba413a5ee56cc602c6b

  • SHA256

    697326b7c02af7d4e12984089d0f9e2b2ff4d8ebad8ea1ce62924958f43aeb70

  • SHA512

    be7a7d4adc9b6fe8bd9c155632c435712aff331badfbd5da9434c213706ad478b3c36ec087a4390f78998188d7baae2fecf4fad69f8ff9dc65c21cba0a4c3517

  • SSDEEP

    24576:3y39LjkZUK2KB6lCm2E9dfQe4KQcYoGbV6FWV8bY1QDWGR:CNLUUK26kr2EH7QZHwWqkO

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      697326b7c02af7d4e12984089d0f9e2b2ff4d8ebad8ea1ce62924958f43aeb70.bin

    • Size

      1.1MB

    • MD5

      87346f5dcbace2e71c85fdddb95da233

    • SHA1

      7887056965a41c17f6982ba413a5ee56cc602c6b

    • SHA256

      697326b7c02af7d4e12984089d0f9e2b2ff4d8ebad8ea1ce62924958f43aeb70

    • SHA512

      be7a7d4adc9b6fe8bd9c155632c435712aff331badfbd5da9434c213706ad478b3c36ec087a4390f78998188d7baae2fecf4fad69f8ff9dc65c21cba0a4c3517

    • SSDEEP

      24576:3y39LjkZUK2KB6lCm2E9dfQe4KQcYoGbV6FWV8bY1QDWGR:CNLUUK26kr2EH7QZHwWqkO

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks