Overview

overview

10

Static

static

3

2ec094aeca...4d.exe

windows7-x64

10

2ec094aeca...4d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ec094aeca5937179eec1109d2812a04496c099ff93bc40dd2def1e42c23584d

  • Size

    479KB

  • Sample

    230506-z1b91agh31

  • MD5

    dee8b6a9f99bdf28422241cb30b8357d

  • SHA1

    754309ac37afcefe91caf5c89b6514bd79077b30

  • SHA256

    2ec094aeca5937179eec1109d2812a04496c099ff93bc40dd2def1e42c23584d

  • SHA512

    c7f7d9e5cfecf18a5cc880e38a40e7492ead02983be8b20fa3282d9524f71266c559c12c3c926f70140b779b94cc36dc116855be568a50c7922a2799747e5f27

  • SSDEEP

    12288:5MrHy90w7fudhar668T5MkLYQbtQHQ8Ipmb:iyDbF5GXtQGpe

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      2ec094aeca5937179eec1109d2812a04496c099ff93bc40dd2def1e42c23584d

    • Size

      479KB

    • MD5

      dee8b6a9f99bdf28422241cb30b8357d

    • SHA1

      754309ac37afcefe91caf5c89b6514bd79077b30

    • SHA256

      2ec094aeca5937179eec1109d2812a04496c099ff93bc40dd2def1e42c23584d

    • SHA512

      c7f7d9e5cfecf18a5cc880e38a40e7492ead02983be8b20fa3282d9524f71266c559c12c3c926f70140b779b94cc36dc116855be568a50c7922a2799747e5f27

    • SSDEEP

      12288:5MrHy90w7fudhar668T5MkLYQbtQHQ8Ipmb:iyDbF5GXtQGpe

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks