Overview

overview

10

Static

static

3

28ee3aee8c...c4.exe

windows7-x64

10

28ee3aee8c...c4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    28ee3aee8cd703410eb02aace64e5f1edbffd588a559f17c808d4f201fd7d0c4.bin

  • Size

    700KB

  • Sample

    230506-zww4lsed35

  • MD5

    e0e8cf775849c0dec622bb785147ce2b

  • SHA1

    8d5b956589fff273a48de69d8ecf8400ce8877f2

  • SHA256

    28ee3aee8cd703410eb02aace64e5f1edbffd588a559f17c808d4f201fd7d0c4

  • SHA512

    59a43ffe22ed99483a930c824a0504ac8cabe95b7a5920949c5fc81f25c22f3a0157db2b60f8b23e0038545e22debadd0c1d838bf71433b642a1178a549e0215

  • SSDEEP

    12288:ey90odOXMqFDg28wgrg0Su+PVwwi/oUzxkypM7tZkqSTeYvamwAquA1xFxo:eyD8MqFDYLS1PV5sdku8n2vKX5jq

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      28ee3aee8cd703410eb02aace64e5f1edbffd588a559f17c808d4f201fd7d0c4.bin

    • Size

      700KB

    • MD5

      e0e8cf775849c0dec622bb785147ce2b

    • SHA1

      8d5b956589fff273a48de69d8ecf8400ce8877f2

    • SHA256

      28ee3aee8cd703410eb02aace64e5f1edbffd588a559f17c808d4f201fd7d0c4

    • SHA512

      59a43ffe22ed99483a930c824a0504ac8cabe95b7a5920949c5fc81f25c22f3a0157db2b60f8b23e0038545e22debadd0c1d838bf71433b642a1178a549e0215

    • SSDEEP

      12288:ey90odOXMqFDg28wgrg0Su+PVwwi/oUzxkypM7tZkqSTeYvamwAquA1xFxo:eyD8MqFDYLS1PV5sdku8n2vKX5jq

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks