Overview

overview

10

Static

static

3

2f2166843d...d2.exe

windows7-x64

10

2f2166843d...d2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2f2166843d1cc17fbc3fce1fa1049f51b80adaba6785f2d80cf5b558194cc3d2.bin

  • Size

    642KB

  • Sample

    230506-z1q36aeh44

  • MD5

    22795df341d8cd1ef1053c1bcf10f1c1

  • SHA1

    84fff17c9fb41c0c9c7f8503251f653ce1f9417b

  • SHA256

    2f2166843d1cc17fbc3fce1fa1049f51b80adaba6785f2d80cf5b558194cc3d2

  • SHA512

    df577befc19b75f267dd69d2f4ca4034f1e77b855857f294b85279966b10b0a45ff6a3de4f3783078834c2b7ebec3e925fe8e7fd2044209265f3bce0163b33dd

  • SSDEEP

    12288:2y90yEUVCFyKZFW+eNDufKa7ivKR8ODcz+b4TWqkSbZAfs0J7lRf:2yBVfvpDufKpUXDL4TbZElZ

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      2f2166843d1cc17fbc3fce1fa1049f51b80adaba6785f2d80cf5b558194cc3d2.bin

    • Size

      642KB

    • MD5

      22795df341d8cd1ef1053c1bcf10f1c1

    • SHA1

      84fff17c9fb41c0c9c7f8503251f653ce1f9417b

    • SHA256

      2f2166843d1cc17fbc3fce1fa1049f51b80adaba6785f2d80cf5b558194cc3d2

    • SHA512

      df577befc19b75f267dd69d2f4ca4034f1e77b855857f294b85279966b10b0a45ff6a3de4f3783078834c2b7ebec3e925fe8e7fd2044209265f3bce0163b33dd

    • SSDEEP

      12288:2y90yEUVCFyKZFW+eNDufKa7ivKR8ODcz+b4TWqkSbZAfs0J7lRf:2yBVfvpDufKpUXDL4TbZElZ

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks