redline

General

Target

2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b.bin
Size

691KB
Sample

230506-z1k7xaeh34
MD5

48f4221b6e1e25997f7dc3871a097590
SHA1

a36f8e4ca498e289c535c98a1b3ab8b47150fdaa
SHA256

2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b
SHA512

73161f743e1bd782b5dd075dd26739695d0f63da73a4afd7a011050e059664b5262df83b8361c0a00afe457ef0dd600a5f03f5444464602baa52d6edaa3f703f
SSDEEP

12288:7y90wGSYMZJis4AKb5x7htBv8M98e2C7CGjUANBlbLqt+78:7yXxnR4r7Dv9n2yAANDbutu8

Score

10^/10

Malware Config

Targets

- Target
  
  2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b.bin
- Size
  
  691KB
- MD5
  
  48f4221b6e1e25997f7dc3871a097590
- SHA1
  
  a36f8e4ca498e289c535c98a1b3ab8b47150fdaa
- SHA256
  
  2f02f817e758fef78cb3a53363f6fabcdc017c047935405cec8837a35d7e722b
- SHA512
  
  73161f743e1bd782b5dd075dd26739695d0f63da73a4afd7a011050e059664b5262df83b8361c0a00afe457ef0dd600a5f03f5444464602baa52d6edaa3f703f
- SSDEEP
  
  12288:7y90wGSYMZJis4AKb5x7htBv8M98e2C7CGjUANBlbLqt+78:7yXxnR4r7Dv9n2yAANDbutu8
Score

10^/10

evasion persistence trojan redline infostealer stealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Redline Stealer samples

Modifies Windows Defender Real-time Protection settings

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2