Overview

overview

10

Static

static

3

0df5796241...22.exe

windows7-x64

10

0df5796241...22.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0df5796241c303435a27a7b5172d2efe839cde2fa7ba25e77c87ae3f4ca20922.bin

  • Size

    1.2MB

  • Sample

    230506-y89pssea6z

  • MD5

    f3126713488423ceff0bd8c50f1d2dbd

  • SHA1

    dc3d474e5b3bdf82f01c04871a51f9920eea7cc6

  • SHA256

    0df5796241c303435a27a7b5172d2efe839cde2fa7ba25e77c87ae3f4ca20922

  • SHA512

    73421349a26eea4c08410058ef24767c3d009e22be3fe8089ccf7bdfb08b7c752aba8195a60f578b696fe55a4b31268251ff39575b5e559d1f4b2a42a3406e53

  • SSDEEP

    24576:AywSrL+uBxolriQHLrACDl8csvITUJ//5sx05wrubwaKTW:HhJxPQP9svIO//5UnruUa

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      0df5796241c303435a27a7b5172d2efe839cde2fa7ba25e77c87ae3f4ca20922.bin

    • Size

      1.2MB

    • MD5

      f3126713488423ceff0bd8c50f1d2dbd

    • SHA1

      dc3d474e5b3bdf82f01c04871a51f9920eea7cc6

    • SHA256

      0df5796241c303435a27a7b5172d2efe839cde2fa7ba25e77c87ae3f4ca20922

    • SHA512

      73421349a26eea4c08410058ef24767c3d009e22be3fe8089ccf7bdfb08b7c752aba8195a60f578b696fe55a4b31268251ff39575b5e559d1f4b2a42a3406e53

    • SSDEEP

      24576:AywSrL+uBxolriQHLrACDl8csvITUJ//5sx05wrubwaKTW:HhJxPQP9svIO//5UnruUa

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks