redline

General

Target

6ca74d26a004d404960e5b206fdf917500f1fbe61503f547b1e6379c53b47424.bin
Size

1.2MB
Sample

230506-2bwcpacc92
MD5

edb656c3762212fc6b3f67af36963253
SHA1

a14033dcbb78df89e1ac0008d65771ad7bc4f02e
SHA256

6ca74d26a004d404960e5b206fdf917500f1fbe61503f547b1e6379c53b47424
SHA512

2a7ff35b2ba8b92e20287193e3ccfa2a05b9ddad43a926fb4b0a57a76a15456e22fa7176aae24ab32b631806ff1fcfe6103fc5c2331ff0844d50fb9d40eafd56
SSDEEP

24576:jcfsVIKzRLTr3vkFjAacR3lMERO6s0fYK++YSYuugo4cyC/:jc+I8X8FjAacEER9NYK+lngo4cyC

Score

10^/10

Malware Config

Targets

- Target
  
  6ca74d26a004d404960e5b206fdf917500f1fbe61503f547b1e6379c53b47424.bin
- Size
  
  1.2MB
- MD5
  
  edb656c3762212fc6b3f67af36963253
- SHA1
  
  a14033dcbb78df89e1ac0008d65771ad7bc4f02e
- SHA256
  
  6ca74d26a004d404960e5b206fdf917500f1fbe61503f547b1e6379c53b47424
- SHA512
  
  2a7ff35b2ba8b92e20287193e3ccfa2a05b9ddad43a926fb4b0a57a76a15456e22fa7176aae24ab32b631806ff1fcfe6103fc5c2331ff0844d50fb9d40eafd56
- SSDEEP
  
  24576:jcfsVIKzRLTr3vkFjAacR3lMERO6s0fYK++YSYuugo4cyC/:jc+I8X8FjAacEER9NYK+lngo4cyC
Score

10^/10

evasion persistence trojan redline infostealer stealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Redline Stealer samples

Modifies Windows Defender Real-time Protection settings

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

We care about your privacy.