Overview

overview

10

Static

static

3

3c58845c02...93.exe

windows7-x64

10

3c58845c02...93.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3c58845c02136ed5a84454155045ef64563890ddf56bf8117f682ea891858a93.bin

  • Size

    1.1MB

  • Sample

    230506-1aspqsaa4s

  • MD5

    ef12d6831ae1e83d95d901ef04b42c57

  • SHA1

    454015af93771583ace1c819a833973ca9cad1d6

  • SHA256

    3c58845c02136ed5a84454155045ef64563890ddf56bf8117f682ea891858a93

  • SHA512

    65672bb1cfc86dc70792f76ce967d403ca972226debe3aca9b6829c09cfa643641ab93ca5bdeb9d492616df124c185c6adca21f678be3ee2a0077b3373316161

  • SSDEEP

    24576:Ry8At1BQzLTGfzTCSsjL6ePn302LEtpuZ6yOiwiz4VO0s:EZ1uzLTQyLz/uDYzEz

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      3c58845c02136ed5a84454155045ef64563890ddf56bf8117f682ea891858a93.bin

    • Size

      1.1MB

    • MD5

      ef12d6831ae1e83d95d901ef04b42c57

    • SHA1

      454015af93771583ace1c819a833973ca9cad1d6

    • SHA256

      3c58845c02136ed5a84454155045ef64563890ddf56bf8117f682ea891858a93

    • SHA512

      65672bb1cfc86dc70792f76ce967d403ca972226debe3aca9b6829c09cfa643641ab93ca5bdeb9d492616df124c185c6adca21f678be3ee2a0077b3373316161

    • SSDEEP

      24576:Ry8At1BQzLTGfzTCSsjL6ePn302LEtpuZ6yOiwiz4VO0s:EZ1uzLTQyLz/uDYzEz

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks