Overview

overview

10

Static

static

3

3318a7e80b...8d.exe

windows7-x64

10

3318a7e80b...8d.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3318a7e80baf4cadb2f5ab2edd33786fa37fbbc267444e98e7a9d70361e2fb8d.bin

  • Size

    1.1MB

  • Sample

    230506-z4b4eafb85

  • MD5

    6d2b167c55ab61ab8c40539570fd0673

  • SHA1

    25e0c9c3c2ac19b16efe77d9fe9d2631c6e978a0

  • SHA256

    3318a7e80baf4cadb2f5ab2edd33786fa37fbbc267444e98e7a9d70361e2fb8d

  • SHA512

    fae676ebbd17685fc68ae3ff7ea17b00ef1e3758b297e2d31792205997aad21f4e072025cb659b1e19ebde335ff0e8af30eb93e4bf621fc7df08c249fecae9e9

  • SSDEEP

    24576:WyQXzzBuXH6PlZ9+1Huv3ObZLDXTEcrr3VJ5IVyCeqyXg6JAr1Y:lQXzzcXaPln+1H+3cFDDf3VJMrRKg

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      3318a7e80baf4cadb2f5ab2edd33786fa37fbbc267444e98e7a9d70361e2fb8d.bin

    • Size

      1.1MB

    • MD5

      6d2b167c55ab61ab8c40539570fd0673

    • SHA1

      25e0c9c3c2ac19b16efe77d9fe9d2631c6e978a0

    • SHA256

      3318a7e80baf4cadb2f5ab2edd33786fa37fbbc267444e98e7a9d70361e2fb8d

    • SHA512

      fae676ebbd17685fc68ae3ff7ea17b00ef1e3758b297e2d31792205997aad21f4e072025cb659b1e19ebde335ff0e8af30eb93e4bf621fc7df08c249fecae9e9

    • SSDEEP

      24576:WyQXzzBuXH6PlZ9+1Huv3ObZLDXTEcrr3VJ5IVyCeqyXg6JAr1Y:lQXzzcXaPln+1H+3cFDDf3VJMrRKg

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks