redline | 4f2e25e78714fd40ee695f0152bc48d5c3bed466f8b85f1d46d4e90fa14b21ca | Triage

Sharing

General

Target

4f2e25e78714fd40ee695f0152bc48d5c3bed466f8b85f1d46d4e90fa14b21ca.bin
Size

641KB
Sample

230506-1qg8yabe6t
MD5

78b0bc6469f36c063c110c77b0c855f6
SHA1

8ef5376a51667d777b50c66b0043758c6fd421cb
SHA256

4f2e25e78714fd40ee695f0152bc48d5c3bed466f8b85f1d46d4e90fa14b21ca
SHA512

74958c3ff04754db5ee4ac5f3c7c9b98fb9ba6f8380e71c0db9a1973332c0b456b40012a1fbb5c94ded1b545555eb24ead53f5e083cc87bdf5334121ce282635
SSDEEP

12288:0y90Hfk22f742DleyKZ/pRCdA62LSySocXIwZuX94U+W8UxH/z0/:0yCbaJ2RrkicYwZXPUxfzU

Score

10^/10

redline evasion infostealer persistence stealer trojan

Malware Config

Targets

- Target
  
  4f2e25e78714fd40ee695f0152bc48d5c3bed466f8b85f1d46d4e90fa14b21ca.bin
- Size
  
  641KB
- MD5
  
  78b0bc6469f36c063c110c77b0c855f6
- SHA1
  
  8ef5376a51667d777b50c66b0043758c6fd421cb
- SHA256
  
  4f2e25e78714fd40ee695f0152bc48d5c3bed466f8b85f1d46d4e90fa14b21ca
- SHA512
  
  74958c3ff04754db5ee4ac5f3c7c9b98fb9ba6f8380e71c0db9a1973332c0b456b40012a1fbb5c94ded1b545555eb24ead53f5e083cc87bdf5334121ce282635
- SSDEEP
  
  12288:0y90Hfk22f742DleyKZ/pRCdA62LSySocXIwZuX94U+W8UxH/z0/:0yCbaJ2RrkicYwZXPUxfzU
Score

10^/10

evasion persistence trojan redline infostealer stealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

redlineevasioninfostealerpersistencestealertrojan