Overview

overview

10

Static

static

3

42bc197e3e...e8.exe

windows7-x64

10

42bc197e3e...e8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    42bc197e3e7a118cbaa22e85ec6457e88c8cc4282feecc35f3bb5b56b50ed8e8.bin

  • Size

    1.2MB

  • Sample

    230506-1ffblage92

  • MD5

    23d3f797a2342ef8d0a69554403c98a5

  • SHA1

    002311fd1296a04b46bdd45101fed88e8ab8478a

  • SHA256

    42bc197e3e7a118cbaa22e85ec6457e88c8cc4282feecc35f3bb5b56b50ed8e8

  • SHA512

    4e9743c9e83a72bdf233cc76b4672e267c04c404b1057085237af11511a1508513ca9ae41998bc070a5f2627195cacf6efd801f984e9f37b8d57313998adf43a

  • SSDEEP

    24576:tc9RstFRHwzmMZlFXCTYaOo2QduHmp8tagFhXskm:tcQrSmdcpOdp/gX

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      42bc197e3e7a118cbaa22e85ec6457e88c8cc4282feecc35f3bb5b56b50ed8e8.bin

    • Size

      1.2MB

    • MD5

      23d3f797a2342ef8d0a69554403c98a5

    • SHA1

      002311fd1296a04b46bdd45101fed88e8ab8478a

    • SHA256

      42bc197e3e7a118cbaa22e85ec6457e88c8cc4282feecc35f3bb5b56b50ed8e8

    • SHA512

      4e9743c9e83a72bdf233cc76b4672e267c04c404b1057085237af11511a1508513ca9ae41998bc070a5f2627195cacf6efd801f984e9f37b8d57313998adf43a

    • SSDEEP

      24576:tc9RstFRHwzmMZlFXCTYaOo2QduHmp8tagFhXskm:tcQrSmdcpOdp/gX

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks