General

  • Target

    1f261c56e266c5c09a0b94379c9196ddce02b125dcc4a4cc8fa98ef1b52cf086.bin

  • Size

    612KB

  • Sample

    230506-znn32afe3v

  • MD5

    d7b66d9b8770b5da9d41200080ea741d

  • SHA1

    4f39fd249ae5970fd5ecbd898d6358aab9fed40c

  • SHA256

    1f261c56e266c5c09a0b94379c9196ddce02b125dcc4a4cc8fa98ef1b52cf086

  • SHA512

    024d72fd4f1c206b3097aca8435ed0a2c8dc146014041032cb660f5288e3edf56ff0b02f4e841888f18cbde5da27eecdc741002470cd62abc5083ec1f69ec365

  • SSDEEP

    12288:7y90PUfO1yQMnL6ONxYWn7s+wUAmAwq2Ra7qOjTKi+Zcw:7yy1MnLfNxYW7FnAmR7Ha4cw

Malware Config

Targets

    • Target

      1f261c56e266c5c09a0b94379c9196ddce02b125dcc4a4cc8fa98ef1b52cf086.bin

    • Size

      612KB

    • MD5

      d7b66d9b8770b5da9d41200080ea741d

    • SHA1

      4f39fd249ae5970fd5ecbd898d6358aab9fed40c

    • SHA256

      1f261c56e266c5c09a0b94379c9196ddce02b125dcc4a4cc8fa98ef1b52cf086

    • SHA512

      024d72fd4f1c206b3097aca8435ed0a2c8dc146014041032cb660f5288e3edf56ff0b02f4e841888f18cbde5da27eecdc741002470cd62abc5083ec1f69ec365

    • SSDEEP

      12288:7y90PUfO1yQMnL6ONxYWn7s+wUAmAwq2Ra7qOjTKi+Zcw:7yy1MnLfNxYW7FnAmR7Ha4cw

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks