Overview

overview

10

Static

static

3

285dd4a904...c2.exe

windows7-x64

10

285dd4a904...c2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    285dd4a90419f041fd06721fa01e04ee24619115520973959a41580f92345bc2.bin

  • Size

    1.1MB

  • Sample

    230506-zwlymsec84

  • MD5

    5108d1aa9f94b5e8511554f066c8abf9

  • SHA1

    538eb5a1a13aa143176af5bb9e2b3b0c326a5ade

  • SHA256

    285dd4a90419f041fd06721fa01e04ee24619115520973959a41580f92345bc2

  • SHA512

    84db650daed460ee4ddfe4b19c5440e412c1fe9fba8897481d1506ebaee0244d68a658659861fc1b7a67401de6b984cbed712cdbe5a509edc044852ed334fba6

  • SSDEEP

    24576:5yWaWc/2fRCDtPLxexwgdRS7El4q02yzNaeQl:sWNc/eAD99EwgdRBl4/DxaeQ

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      285dd4a90419f041fd06721fa01e04ee24619115520973959a41580f92345bc2.bin

    • Size

      1.1MB

    • MD5

      5108d1aa9f94b5e8511554f066c8abf9

    • SHA1

      538eb5a1a13aa143176af5bb9e2b3b0c326a5ade

    • SHA256

      285dd4a90419f041fd06721fa01e04ee24619115520973959a41580f92345bc2

    • SHA512

      84db650daed460ee4ddfe4b19c5440e412c1fe9fba8897481d1506ebaee0244d68a658659861fc1b7a67401de6b984cbed712cdbe5a509edc044852ed334fba6

    • SSDEEP

      24576:5yWaWc/2fRCDtPLxexwgdRS7El4q02yzNaeQl:sWNc/eAD99EwgdRBl4/DxaeQ

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks