Overview

overview

10

Static

static

3

2eb6c2c268...09.exe

windows7-x64

10

2eb6c2c268...09.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2eb6c2c26894452c215f0c4dc145c60f04dc9cbcd1b73ae3aea2dada78b59109.bin

  • Size

    690KB

  • Sample

    230506-z1bcpseg92

  • MD5

    c498159ab9dc78adc254a3fbdf123c1b

  • SHA1

    bb0f2eaa238a7ab01af99522eeb24785866b276c

  • SHA256

    2eb6c2c26894452c215f0c4dc145c60f04dc9cbcd1b73ae3aea2dada78b59109

  • SHA512

    7d18539601647b72054eb50d723a6168add6660e6a6b48299c1ad9526101d12cf4caf50c0058a4a5504a319eb11148b7d2c1be2375f444b98de44c5e7687bce7

  • SSDEEP

    12288:by908KrOTHAPgY4v9vf1vwxwK7qQ0aed2ImbvfLPN:byKStBwlve2IuvTPN

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      2eb6c2c26894452c215f0c4dc145c60f04dc9cbcd1b73ae3aea2dada78b59109.bin

    • Size

      690KB

    • MD5

      c498159ab9dc78adc254a3fbdf123c1b

    • SHA1

      bb0f2eaa238a7ab01af99522eeb24785866b276c

    • SHA256

      2eb6c2c26894452c215f0c4dc145c60f04dc9cbcd1b73ae3aea2dada78b59109

    • SHA512

      7d18539601647b72054eb50d723a6168add6660e6a6b48299c1ad9526101d12cf4caf50c0058a4a5504a319eb11148b7d2c1be2375f444b98de44c5e7687bce7

    • SSDEEP

      12288:by908KrOTHAPgY4v9vf1vwxwK7qQ0aed2ImbvfLPN:byKStBwlve2IuvTPN

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks