Overview

overview

10

Static

static

3

08f52ef6d3...d0.exe

windows7-x64

10

08f52ef6d3...d0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    08f52ef6d31d21399983ed9f3d4b61a0b31678a18d5072489e29720270e242d0.bin

  • Size

    1000KB

  • Sample

    230506-y5l5bsdf4t

  • MD5

    cd6e7fcf01ebb32e41313ff32b488628

  • SHA1

    ac5b3bf16b94b54e8668e7262be11915dc94e5cd

  • SHA256

    08f52ef6d31d21399983ed9f3d4b61a0b31678a18d5072489e29720270e242d0

  • SHA512

    89eed4fb07f8320e6399e1727ab46070500efd43370c3b4288cce68b3e4dadf3641983a2e0c4e32e3117651dd1d71254d3e9f25a9aa6371ff58b27815b196b76

  • SSDEEP

    24576:Oy6VN3VgyY7YqSl5aPEOpOKcTpAlqi1Xf:deleBYy7OPVAlz

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      08f52ef6d31d21399983ed9f3d4b61a0b31678a18d5072489e29720270e242d0.bin

    • Size

      1000KB

    • MD5

      cd6e7fcf01ebb32e41313ff32b488628

    • SHA1

      ac5b3bf16b94b54e8668e7262be11915dc94e5cd

    • SHA256

      08f52ef6d31d21399983ed9f3d4b61a0b31678a18d5072489e29720270e242d0

    • SHA512

      89eed4fb07f8320e6399e1727ab46070500efd43370c3b4288cce68b3e4dadf3641983a2e0c4e32e3117651dd1d71254d3e9f25a9aa6371ff58b27815b196b76

    • SSDEEP

      24576:Oy6VN3VgyY7YqSl5aPEOpOKcTpAlqi1Xf:deleBYy7OPVAlz

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks