Overview

overview

10

Static

static

3

6df90a1167...04.exe

windows7-x64

10

6df90a1167...04.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6df90a11671bf99b0557440d805fa304b37fe52b62aa505c279cffbcda309d04

  • Size

    480KB

  • Sample

    230506-2cre5aeb9w

  • MD5

    f9badbe4ddac448f57ad1b6e4c31f4d3

  • SHA1

    edfd8bd61024795e432dd7259e5a6b6eb6ae38ff

  • SHA256

    6df90a11671bf99b0557440d805fa304b37fe52b62aa505c279cffbcda309d04

  • SHA512

    38f6c3cf805895fba713e2c1492f5a7598a5cba2de372a99c353b0cf9998c0d5a405cedf56da777cbd1b45d910944bbc7d6df81802fb4089f043cdd9a5ab114a

  • SSDEEP

    12288:/Mruy90c/kSJekUvMttOXaIKBYXGTWmaAmZ59O:hyr/0Mt4Xn2WfdO

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      6df90a11671bf99b0557440d805fa304b37fe52b62aa505c279cffbcda309d04

    • Size

      480KB

    • MD5

      f9badbe4ddac448f57ad1b6e4c31f4d3

    • SHA1

      edfd8bd61024795e432dd7259e5a6b6eb6ae38ff

    • SHA256

      6df90a11671bf99b0557440d805fa304b37fe52b62aa505c279cffbcda309d04

    • SHA512

      38f6c3cf805895fba713e2c1492f5a7598a5cba2de372a99c353b0cf9998c0d5a405cedf56da777cbd1b45d910944bbc7d6df81802fb4089f043cdd9a5ab114a

    • SSDEEP

      12288:/Mruy90c/kSJekUvMttOXaIKBYXGTWmaAmZ59O:hyr/0Mt4Xn2WfdO

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks