Overview

overview

10

Static

static

3

f5c3a58326...09.exe

windows7-x64

10

f5c3a58326...09.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0031ac3c2233beafdd21fd12980f7baa.bin

  • Size

    1.1MB

  • Sample

    230506-2f46dsef5v

  • MD5

    32a449c91a6beba11f59eadb7a292fb9

  • SHA1

    6c30c1dbda4421d25688fb69458724e763a11e50

  • SHA256

    55c42328caf5c22e093ff41c7a2c55d34d05f730d6fed1b729a06889c7549758

  • SHA512

    4b0fc0a56c6f80ae83431b5dc703e0e6670837345391149d5f9abd23e1f43020ef35aa68a601f726cf545f5219098a8a4c1210bb90cff2a4fa953847a6c740d1

  • SSDEEP

    24576:hriWMzFxhDT8dDktNGwYo+jV86W+T0EeEeURRmou7T:hrtcfhM5kTNY9P0vEdRm1T

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      f5c3a58326366577dab5c242766f27ef109484b04f927a378d16730960e4ad09.exe

    • Size

      1.2MB

    • MD5

      0031ac3c2233beafdd21fd12980f7baa

    • SHA1

      3bb1c4fd8310567292cd45bf55719ab1ea86ecb0

    • SHA256

      f5c3a58326366577dab5c242766f27ef109484b04f927a378d16730960e4ad09

    • SHA512

      cda562e40ec16313bd63019f550f8c2ebb5fb8a1f1b7b7409a55de7ee0caddc97c571ad3477e7a64be26bf78c4bf4445ebf40a08b3b35ef35084b0be56a66a3e

    • SSDEEP

      24576:OYfpUXN4pJObch6IIj4y/J7eiLQoHn1zB/hN37JQjXfsTedQ4hF:dfwNsjhHITR7emQ+n1z1DlQjk

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks