Overview

overview

10

Static

static

3

357e6c66a1...69.exe

windows7-x64

10

357e6c66a1...69.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    357e6c66a1e82cc3ec4cbcafab36088ba1a05f9471a89ff8cbd7fea8b80ac969.bin

  • Size

    651KB

  • Sample

    230506-z55r4sfd84

  • MD5

    b266c2dab55b52dfddaf970f32116ac2

  • SHA1

    f69c345c9bb785b511933dd699fd562c77b77345

  • SHA256

    357e6c66a1e82cc3ec4cbcafab36088ba1a05f9471a89ff8cbd7fea8b80ac969

  • SHA512

    3cb57dee3604b80304334cd35bd7e3ede79fa283fa3ba4d163267d57fb3cf93d3a15ef97abf6912fab0951eb209ba87eabd7ecc3554ea2bfab8b5d0655deb067

  • SSDEEP

    12288:py90kouMV8VItJ4P6r+ZaJ+VUpIRctvuLzOnYDEppdU:pyuuMVttJ4P6rnva6I4qau

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      357e6c66a1e82cc3ec4cbcafab36088ba1a05f9471a89ff8cbd7fea8b80ac969.bin

    • Size

      651KB

    • MD5

      b266c2dab55b52dfddaf970f32116ac2

    • SHA1

      f69c345c9bb785b511933dd699fd562c77b77345

    • SHA256

      357e6c66a1e82cc3ec4cbcafab36088ba1a05f9471a89ff8cbd7fea8b80ac969

    • SHA512

      3cb57dee3604b80304334cd35bd7e3ede79fa283fa3ba4d163267d57fb3cf93d3a15ef97abf6912fab0951eb209ba87eabd7ecc3554ea2bfab8b5d0655deb067

    • SSDEEP

      12288:py90kouMV8VItJ4P6r+ZaJ+VUpIRctvuLzOnYDEppdU:pyuuMVttJ4P6rnva6I4qau

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks