Overview

overview

10

Static

static

3

33b569a043...f2.exe

windows7-x64

10

33b569a043...f2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    33b569a04358a8535a65b1bc839bb3d4cf4e48fb5dc3b9ebf94a184c628b48f2

  • Size

    480KB

  • Sample

    230506-z4tcpahd3v

  • MD5

    4ed7b05d50272e656079083623f7e53c

  • SHA1

    f1ba142eee974be63cc8cc97b9306fb08c38a221

  • SHA256

    33b569a04358a8535a65b1bc839bb3d4cf4e48fb5dc3b9ebf94a184c628b48f2

  • SHA512

    371db4f51db084cccf5c313ec687b9aa8668aa6e3e3e452669b5cc40ad16a9aa09328df1098b3f91fbdff5cc1257360be07b363da9afe7d4b331dcdb6a28a0cd

  • SSDEEP

    12288:xMrRy90OWcXI75TdBODPaUpC9Hc7k4JcX2:cy9O9dsDFpCKhcm

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      33b569a04358a8535a65b1bc839bb3d4cf4e48fb5dc3b9ebf94a184c628b48f2

    • Size

      480KB

    • MD5

      4ed7b05d50272e656079083623f7e53c

    • SHA1

      f1ba142eee974be63cc8cc97b9306fb08c38a221

    • SHA256

      33b569a04358a8535a65b1bc839bb3d4cf4e48fb5dc3b9ebf94a184c628b48f2

    • SHA512

      371db4f51db084cccf5c313ec687b9aa8668aa6e3e3e452669b5cc40ad16a9aa09328df1098b3f91fbdff5cc1257360be07b363da9afe7d4b331dcdb6a28a0cd

    • SSDEEP

      12288:xMrRy90OWcXI75TdBODPaUpC9Hc7k4JcX2:cy9O9dsDFpCKhcm

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks