Overview

overview

10

Static

static

3

3a51763539...21.exe

windows7-x64

10

3a51763539...21.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a51763539282e69773f498575af0a733bf362e8ccaf143460696da2d90af521.bin

  • Size

    1.1MB

  • Sample

    230506-z9dt7afh27

  • MD5

    2281725c118fe1bfcdf8634adc23d958

  • SHA1

    e2173a63f12226b737f848a12793327507ae9ce6

  • SHA256

    3a51763539282e69773f498575af0a733bf362e8ccaf143460696da2d90af521

  • SHA512

    974959eee0ef9ecf2daea707bc367a223b921f9ef089f8e739d06e634c6b5a5e8f73dcf4961e0ea975c83eaaa4c55f268448fc22bb3949fd81328babb3312936

  • SSDEEP

    24576:xytY+nQkIHifchANJ0MVu48S9Ng9x+Dr43xXryCt59/:kdIHifBTVuFSm+/43hryG5

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      3a51763539282e69773f498575af0a733bf362e8ccaf143460696da2d90af521.bin

    • Size

      1.1MB

    • MD5

      2281725c118fe1bfcdf8634adc23d958

    • SHA1

      e2173a63f12226b737f848a12793327507ae9ce6

    • SHA256

      3a51763539282e69773f498575af0a733bf362e8ccaf143460696da2d90af521

    • SHA512

      974959eee0ef9ecf2daea707bc367a223b921f9ef089f8e739d06e634c6b5a5e8f73dcf4961e0ea975c83eaaa4c55f268448fc22bb3949fd81328babb3312936

    • SSDEEP

      24576:xytY+nQkIHifchANJ0MVu48S9Ng9x+Dr43xXryCt59/:kdIHifBTVuFSm+/43hryG5

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks