Overview

overview

10

Static

static

3

34b578d3cd...c2.exe

windows7-x64

7

34b578d3cd...c2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    34b578d3cdc3cf4ec9316712175c03a1a899ed5b52b71efae00168efb725ccc2

  • Size

    376KB

  • Sample

    230506-z5hycafd28

  • MD5

    10848a8b1717c589f3a62ac691b791d3

  • SHA1

    b206d74cb2e8f0cf2aa0baa3ad6e07ab7813f6dc

  • SHA256

    34b578d3cdc3cf4ec9316712175c03a1a899ed5b52b71efae00168efb725ccc2

  • SHA512

    79c219602f2b1106e2ca6e7d0b8b5009fed5d200d12b60aac03d2bbb99fa177b229d776891b9cd03722649ba524814d83bb7cd1764ae0e451153ef5b5cf826f8

  • SSDEEP

    6144:Kjy+bnr+5p0yN90QEOWmE/LS5ca3CV/9NpuOxh6+hUvqPmaxuSryA:FMr5y90DmqeCjbh6TSPmFm

Score
10/10
redlineinfostealerpersistencestealer

Malware Config

Targets

    • Target

      34b578d3cdc3cf4ec9316712175c03a1a899ed5b52b71efae00168efb725ccc2

    • Size

      376KB

    • MD5

      10848a8b1717c589f3a62ac691b791d3

    • SHA1

      b206d74cb2e8f0cf2aa0baa3ad6e07ab7813f6dc

    • SHA256

      34b578d3cdc3cf4ec9316712175c03a1a899ed5b52b71efae00168efb725ccc2

    • SHA512

      79c219602f2b1106e2ca6e7d0b8b5009fed5d200d12b60aac03d2bbb99fa177b229d776891b9cd03722649ba524814d83bb7cd1764ae0e451153ef5b5cf826f8

    • SSDEEP

      6144:Kjy+bnr+5p0yN90QEOWmE/LS5ca3CV/9NpuOxh6+hUvqPmaxuSryA:FMr5y90DmqeCjbh6TSPmFm

    Score
    10/10
    persistenceredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks