General

  • Target

    6e37fd45e7a00d5e9545debed534a932ae399a78ee4d41bbde67756f857710ab

  • Size

    376KB

  • Sample

    230506-2cvsjscd86

  • MD5

    7f52386451df31b8cb84807535f3daf9

  • SHA1

    f97019ad320455e6e95b56e63629c72750386b91

  • SHA256

    6e37fd45e7a00d5e9545debed534a932ae399a78ee4d41bbde67756f857710ab

  • SHA512

    9e2ae0bdb3333edec86978656f0808a277ce2b64433074b91e94e4874ad378bc8cff16337c483a1616f055cbd26581fe72b014f4023a5e739d8f8d2681cd168a

  • SSDEEP

    6144:K0y+bnr+Ip0yN90QESOwQhVK5hn5MYA50QOdLuwK38hV7X8ZKwd:MMrYy90sM3KqYtQOZK0VCR

Malware Config

Targets

    • Target

      6e37fd45e7a00d5e9545debed534a932ae399a78ee4d41bbde67756f857710ab

    • Size

      376KB

    • MD5

      7f52386451df31b8cb84807535f3daf9

    • SHA1

      f97019ad320455e6e95b56e63629c72750386b91

    • SHA256

      6e37fd45e7a00d5e9545debed534a932ae399a78ee4d41bbde67756f857710ab

    • SHA512

      9e2ae0bdb3333edec86978656f0808a277ce2b64433074b91e94e4874ad378bc8cff16337c483a1616f055cbd26581fe72b014f4023a5e739d8f8d2681cd168a

    • SSDEEP

      6144:K0y+bnr+Ip0yN90QESOwQhVK5hn5MYA50QOdLuwK38hV7X8ZKwd:MMrYy90sM3KqYtQOZK0VCR

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks