Overview

overview

10

Static

static

3

2abd2bee18...b9.exe

windows7-x64

10

2abd2bee18...b9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2abd2bee18305192e765f3195cffbc77f870d8dc0c6e358c176c0d2944b9aab9.bin

  • Size

    890KB

  • Sample

    230506-zx219age61

  • MD5

    e75931bec46b15831e95e3fd8b9f98e5

  • SHA1

    78e6e7d9de460d78757a51b37669b98379144dd9

  • SHA256

    2abd2bee18305192e765f3195cffbc77f870d8dc0c6e358c176c0d2944b9aab9

  • SHA512

    59f2ff0b7a435530b1da70d0f07692b4ace0b814c040a5bf421e68cc3e89566ea64563cc443edf1d2619dd0ab6a8659f903ad578ec55649dbab9479e77cb94bc

  • SSDEEP

    24576:iyWPnnaBBFzw7wLzufkh0AqRMIr0j/o8Ee:JWPaPFzw8Lq+1XIeQ

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      2abd2bee18305192e765f3195cffbc77f870d8dc0c6e358c176c0d2944b9aab9.bin

    • Size

      890KB

    • MD5

      e75931bec46b15831e95e3fd8b9f98e5

    • SHA1

      78e6e7d9de460d78757a51b37669b98379144dd9

    • SHA256

      2abd2bee18305192e765f3195cffbc77f870d8dc0c6e358c176c0d2944b9aab9

    • SHA512

      59f2ff0b7a435530b1da70d0f07692b4ace0b814c040a5bf421e68cc3e89566ea64563cc443edf1d2619dd0ab6a8659f903ad578ec55649dbab9479e77cb94bc

    • SSDEEP

      24576:iyWPnnaBBFzw7wLzufkh0AqRMIr0j/o8Ee:JWPaPFzw8Lq+1XIeQ

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks