General

  • Target

    6c55a82d46bcd5ee70b37a108eff2944fe9e5a9d558ef21dd87ffbbc8bfcbc3e.bin

  • Size

    651KB

  • Sample

    230506-2blhgscc73

  • MD5

    8c6b9f9101b53856d79f5a59b664b938

  • SHA1

    7071f5cb32d91b1ee63b3ca6c678b400c409f8fb

  • SHA256

    6c55a82d46bcd5ee70b37a108eff2944fe9e5a9d558ef21dd87ffbbc8bfcbc3e

  • SHA512

    09b654a57b180c8baa6c8a088d2339a185f70e07ca1774d49ca8ed99a19ece8e7110724e5f0e427ceab2cae27365f4f2c8212ce7bdcb9d8a39488374f5cb3987

  • SSDEEP

    12288:ay90vlp3v/jyCPPFbPh27+jPsGpnKNDNuqhlx6dkQmPUvK:ayQNDyIPhPh26jPENPhn6C

Malware Config

Targets

    • Target

      6c55a82d46bcd5ee70b37a108eff2944fe9e5a9d558ef21dd87ffbbc8bfcbc3e.bin

    • Size

      651KB

    • MD5

      8c6b9f9101b53856d79f5a59b664b938

    • SHA1

      7071f5cb32d91b1ee63b3ca6c678b400c409f8fb

    • SHA256

      6c55a82d46bcd5ee70b37a108eff2944fe9e5a9d558ef21dd87ffbbc8bfcbc3e

    • SHA512

      09b654a57b180c8baa6c8a088d2339a185f70e07ca1774d49ca8ed99a19ece8e7110724e5f0e427ceab2cae27365f4f2c8212ce7bdcb9d8a39488374f5cb3987

    • SSDEEP

      12288:ay90vlp3v/jyCPPFbPh27+jPsGpnKNDNuqhlx6dkQmPUvK:ayQNDyIPhPh26jPENPhn6C

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks