Overview

overview

10

Static

static

3

2dd47ef361...bc.exe

windows7-x64

10

2dd47ef361...bc.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2dd47ef3617241eb143b305c79903af25b8133789f41f3f932254b60f8cdf9bc.bin

  • Size

    697KB

  • Sample

    230506-zzs65aeg48

  • MD5

    6cfe592ebbafb471c44000cf0c66ea3c

  • SHA1

    8a21f8ef82db393e1fce2b728c94bfb594e468bb

  • SHA256

    2dd47ef3617241eb143b305c79903af25b8133789f41f3f932254b60f8cdf9bc

  • SHA512

    6204ab02de2416ec5297c2620d4e58131649835988c45c5753c54240ed87c7d3bb44e032be02c7cc05ac4c8531349241b677023748d1f58502acec448f23a6e6

  • SSDEEP

    12288:Wy90nTr9TWlxFLNCXZIpGmq0CvAj1WjGtJcWmEbQFTdbfa4Jq9JhFK+k:WyWTr96lxxNgZSGmqiUjkJEPTVd+hlk

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      2dd47ef3617241eb143b305c79903af25b8133789f41f3f932254b60f8cdf9bc.bin

    • Size

      697KB

    • MD5

      6cfe592ebbafb471c44000cf0c66ea3c

    • SHA1

      8a21f8ef82db393e1fce2b728c94bfb594e468bb

    • SHA256

      2dd47ef3617241eb143b305c79903af25b8133789f41f3f932254b60f8cdf9bc

    • SHA512

      6204ab02de2416ec5297c2620d4e58131649835988c45c5753c54240ed87c7d3bb44e032be02c7cc05ac4c8531349241b677023748d1f58502acec448f23a6e6

    • SSDEEP

      12288:Wy90nTr9TWlxFLNCXZIpGmq0CvAj1WjGtJcWmEbQFTdbfa4Jq9JhFK+k:WyWTr96lxxNgZSGmqiUjkJEPTVd+hlk

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks