Overview

overview

10

Static

static

3

5a02caf613...47.exe

windows7-x64

10

5a02caf613...47.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5a02caf613425091ee8dd246ac8a48bfa306b6f2267a86348bd9136ec0dc2847

  • Size

    376KB

  • Sample

    230506-1yz4qaaf37

  • MD5

    6d3e38c933013175e445af356a01016b

  • SHA1

    0bd85650846a2a2fc97a9cbb96c867d92010c7ae

  • SHA256

    5a02caf613425091ee8dd246ac8a48bfa306b6f2267a86348bd9136ec0dc2847

  • SHA512

    1e4e33c7a94f5c57b0908aa17906b58fef6100a65e60ce5efafa837dc779d4c782ad836fe5d709cda4d56c2ff1b64bed06a54fcaa67d8a01cdfaee9e333b23d6

  • SSDEEP

    6144:KEy+bnr+Kp0yN90QESlvHLLWbJoubXaVIyDtAPlYvRheAH8OnAZXwtpY:wMriy90kxHLS1lbXamyuCcGhtpY

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      5a02caf613425091ee8dd246ac8a48bfa306b6f2267a86348bd9136ec0dc2847

    • Size

      376KB

    • MD5

      6d3e38c933013175e445af356a01016b

    • SHA1

      0bd85650846a2a2fc97a9cbb96c867d92010c7ae

    • SHA256

      5a02caf613425091ee8dd246ac8a48bfa306b6f2267a86348bd9136ec0dc2847

    • SHA512

      1e4e33c7a94f5c57b0908aa17906b58fef6100a65e60ce5efafa837dc779d4c782ad836fe5d709cda4d56c2ff1b64bed06a54fcaa67d8a01cdfaee9e333b23d6

    • SSDEEP

      6144:KEy+bnr+Kp0yN90QESlvHLLWbJoubXaVIyDtAPlYvRheAH8OnAZXwtpY:wMriy90kxHLS1lbXamyuCcGhtpY

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks