Overview

overview

10

Static

static

3

3ba0ac74e0...54.exe

windows7-x64

10

3ba0ac74e0...54.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3ba0ac74e070a7ff0c14526588b25c493444172ef6d36d52c0b3cdfd659ade54

  • Size

    491KB

  • Sample

    230506-1ac92sga26

  • MD5

    f941e1edd08873ed807e2e586321b50e

  • SHA1

    ef057d2168d1bd41566c5945ceccc81f0a4cf42e

  • SHA256

    3ba0ac74e070a7ff0c14526588b25c493444172ef6d36d52c0b3cdfd659ade54

  • SHA512

    693ee64b644f2d11bace405c6ffa9e43588183f2e88cc164ccdeef7b40a177a103a1d6b189d8dcc650c1b946cbb5049f06c1c0bb95971cb03acf33afdb88143e

  • SSDEEP

    12288:cMrqy90mUzXx7DaaO+yAfKGjO4CLJs/Yn4/Ynrszbg:ey9UbUKUGq47/Yi+Qzbg

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      3ba0ac74e070a7ff0c14526588b25c493444172ef6d36d52c0b3cdfd659ade54

    • Size

      491KB

    • MD5

      f941e1edd08873ed807e2e586321b50e

    • SHA1

      ef057d2168d1bd41566c5945ceccc81f0a4cf42e

    • SHA256

      3ba0ac74e070a7ff0c14526588b25c493444172ef6d36d52c0b3cdfd659ade54

    • SHA512

      693ee64b644f2d11bace405c6ffa9e43588183f2e88cc164ccdeef7b40a177a103a1d6b189d8dcc650c1b946cbb5049f06c1c0bb95971cb03acf33afdb88143e

    • SSDEEP

      12288:cMrqy90mUzXx7DaaO+yAfKGjO4CLJs/Yn4/Ynrszbg:ey9UbUKUGq47/Yi+Qzbg

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks