redline

General

Target

1cc8de61685ced27317a99c7f04145f5a732bffa2a1bb062d5518d0165d5f9ba
Size

1.2MB
Sample

230506-3tc5habf7v
MD5

a97748f56e8ebc584cb4e09f55419ec2
SHA1

af7da012d6acb8a207487c4581a1b80eeaeb7a62
SHA256

1cc8de61685ced27317a99c7f04145f5a732bffa2a1bb062d5518d0165d5f9ba
SHA512

1d9759acb064ae17b4edcba626b7b26b1365e51eef19a422c9f660962ab2ad7cc41999e5832bdd2c988f9c68c8c3b6de3e1087acfe1492bd0afadae65ebbf153
SSDEEP

24576:W0zwEbpelsnjkyfxpcP7kJxnSnF83PRiGBgy3rIgBQzbypT6bg6gO:W0zNUYjkCcPoJgK3ss+y4bN

Score

10^/10

Malware Config

Targets

- Target
  
  1cc8de61685ced27317a99c7f04145f5a732bffa2a1bb062d5518d0165d5f9ba
- Size
  
  1.2MB
- MD5
  
  a97748f56e8ebc584cb4e09f55419ec2
- SHA1
  
  af7da012d6acb8a207487c4581a1b80eeaeb7a62
- SHA256
  
  1cc8de61685ced27317a99c7f04145f5a732bffa2a1bb062d5518d0165d5f9ba
- SHA512
  
  1d9759acb064ae17b4edcba626b7b26b1365e51eef19a422c9f660962ab2ad7cc41999e5832bdd2c988f9c68c8c3b6de3e1087acfe1492bd0afadae65ebbf153
- SSDEEP
  
  24576:W0zwEbpelsnjkyfxpcP7kJxnSnF83PRiGBgy3rIgBQzbypT6bg6gO:W0zNUYjkCcPoJgK3ss+y4bN
Score

10^/10

evasion persistence trojan redline infostealer stealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Detects Redline Stealer samples

Modifies Windows Defender Real-time Protection settings

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2