redline | 1296528797a30c328c83483e147d9bf109ba08803d544e84dde1968e437b98e9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1296528797a30c328c83483e147d9bf109ba08803d544e84dde1968e437b98e9
Size

376KB
Sample

230506-zcqgqacb96
MD5

31478ce7a44847dd4f314aad6e60a52d
SHA1

e493606b25a2ab7c7cfff57d0f2fb34aa4904537
SHA256

1296528797a30c328c83483e147d9bf109ba08803d544e84dde1968e437b98e9
SHA512

6c9bb4d704abf56dcab897dd554d30dd96eea3be14e2bbdcb2cc1e7175d271c3449fdabd3e551b54dbb814a80bc9ccc0be2432e9d9c615cc7fbe9fb913d995c9
SSDEEP

6144:K4y+bnr+Jp0yN90QEfW8/CwUjpYQCT7eRYF51KrywBeYhnenTECKyB64gnfahYFQ:0MrZy90HngzM7EUurywBFhncK+64gKYG

Score

10^/10

redline infostealer persistence stealer

Malware Config

Targets

- Target
  
  1296528797a30c328c83483e147d9bf109ba08803d544e84dde1968e437b98e9
- Size
  
  376KB
- MD5
  
  31478ce7a44847dd4f314aad6e60a52d
- SHA1
  
  e493606b25a2ab7c7cfff57d0f2fb34aa4904537
- SHA256
  
  1296528797a30c328c83483e147d9bf109ba08803d544e84dde1968e437b98e9
- SHA512
  
  6c9bb4d704abf56dcab897dd554d30dd96eea3be14e2bbdcb2cc1e7175d271c3449fdabd3e551b54dbb814a80bc9ccc0be2432e9d9c615cc7fbe9fb913d995c9
- SSDEEP
  
  6144:K4y+bnr+Jp0yN90QEfW8/CwUjpYQCT7eRYF51KrywBeYhnenTECKyB64gnfahYFQ:0MrZy90HngzM7EUurywBFhncK+64gKYG
Score

10^/10

persistence redline infostealer stealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

redlineinfostealerpersistencestealer