Overview

overview

10

Static

static

3

6ca8fc3d3a...75.exe

windows7-x64

10

6ca8fc3d3a...75.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6ca8fc3d3a039d1861688483fe9c33aa1854e6101354d078267945f017d11e75

  • Size

    488KB

  • Sample

    230506-2bwcpacc93

  • MD5

    7a424b604c2000ca66b199d51fe3e671

  • SHA1

    4a6bbbadf586993ddf079cec9a6176d3ca568fbb

  • SHA256

    6ca8fc3d3a039d1861688483fe9c33aa1854e6101354d078267945f017d11e75

  • SHA512

    c6903a1d971bd211302cf4ae43fe49f4fdd7adb99a3597c1271043306ce7f1ed3d22ece42bda44a56a309cb548cead3fdd1b17947e07069f7c261df30cb3379e

  • SSDEEP

    12288:3Mr0y90Fz8Zq+Qvfu/+TxDfT1TWrHFj86R:ry2ZLvGWhSJ86R

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      6ca8fc3d3a039d1861688483fe9c33aa1854e6101354d078267945f017d11e75

    • Size

      488KB

    • MD5

      7a424b604c2000ca66b199d51fe3e671

    • SHA1

      4a6bbbadf586993ddf079cec9a6176d3ca568fbb

    • SHA256

      6ca8fc3d3a039d1861688483fe9c33aa1854e6101354d078267945f017d11e75

    • SHA512

      c6903a1d971bd211302cf4ae43fe49f4fdd7adb99a3597c1271043306ce7f1ed3d22ece42bda44a56a309cb548cead3fdd1b17947e07069f7c261df30cb3379e

    • SSDEEP

      12288:3Mr0y90Fz8Zq+Qvfu/+TxDfT1TWrHFj86R:ry2ZLvGWhSJ86R

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks