General

  • Target

    1252e0cd9dc91d610e131e5bf9f7061414ca1fc335ed66c05332f95677c450fc.bin

  • Size

    611KB

  • Sample

    230506-zcltjacb83

  • MD5

    45efb40ba04100e6bad265d0188eb555

  • SHA1

    cfa1b9925e560e079aa165fe019791884df7fdfa

  • SHA256

    1252e0cd9dc91d610e131e5bf9f7061414ca1fc335ed66c05332f95677c450fc

  • SHA512

    cb719726efcbbafd3d34353c008a17b138de8c7a12e3bce69aa04a59ea5a5279f2e6e0cdb601a9ad0452fe7b0ef4a9b6060a9d383ef3b1c93803fb823e74d3a7

  • SSDEEP

    12288:2y90lIaPwQ+Ab4MuIgrfqWhnO9J0rttX8d2De/K/HPFZq1Z:2yJaP/5uvq0aUtXU2VS1Z

Malware Config

Targets

    • Target

      1252e0cd9dc91d610e131e5bf9f7061414ca1fc335ed66c05332f95677c450fc.bin

    • Size

      611KB

    • MD5

      45efb40ba04100e6bad265d0188eb555

    • SHA1

      cfa1b9925e560e079aa165fe019791884df7fdfa

    • SHA256

      1252e0cd9dc91d610e131e5bf9f7061414ca1fc335ed66c05332f95677c450fc

    • SHA512

      cb719726efcbbafd3d34353c008a17b138de8c7a12e3bce69aa04a59ea5a5279f2e6e0cdb601a9ad0452fe7b0ef4a9b6060a9d383ef3b1c93803fb823e74d3a7

    • SSDEEP

      12288:2y90lIaPwQ+Ab4MuIgrfqWhnO9J0rttX8d2De/K/HPFZq1Z:2yJaP/5uvq0aUtXU2VS1Z

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks