Overview

overview

10

Static

static

3

1a0855cd82...5e.exe

windows7-x64

10

1a0855cd82...5e.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    575fc95de1151ff6e48051db9e35cce0.bin.bin

  • Size

    1.0MB

  • Sample

    230506-1xfcxsad46

  • MD5

    dc0b7c39dece586a24963189c6a58808

  • SHA1

    190ed9c828a0e427cd5cf736e314b180001e637a

  • SHA256

    6ead60d69834c9ddf7396a410562677fefb84edd51d0b2fb8aa7b7c3d5a9889c

  • SHA512

    e3a303478f79ffa95347e764756f7908a9c660cd9879fe76af7b7000e47f5e2965156b6a10b89dea3e5679a692680834386de729c94fce5cd9c187d0ca00312c

  • SSDEEP

    24576:XfMxLJrOZj6k3OzyCTsx0azktHW7wLAtYfp5brj5nS:XfMlJrOZ5OVTQzp7wLAOjbrj5nS

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      1a0855cd8273c21351df126d028c2f0a86c1f89cd89b0650dc7a682047b40d5e.exe

    • Size

      1.1MB

    • MD5

      575fc95de1151ff6e48051db9e35cce0

    • SHA1

      7a3b394ed13303c59e9daed40ce6c01aed141563

    • SHA256

      1a0855cd8273c21351df126d028c2f0a86c1f89cd89b0650dc7a682047b40d5e

    • SHA512

      1f90870351df992ff1db9a30a7d7c70133f3d6dc727a5b73d9baffe5a4bb358569fb12f354b5acb3daa0d74b145bef4aad2575a9615f43166ecfbaeb8090dd84

    • SSDEEP

      24576:8yfPdYu3nYhoIVArUVs8hY3U/QaioWMvwtWNSI+G7J65Oy:rflB3nYhoIdV53/QLoZvwtWH+m65

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks