redline | 2df1281b92cda25e162adf8cff728037f97eb1842ea6ec48b944fc661530adba | Triage

Sharing

General

Target

2df1281b92cda25e162adf8cff728037f97eb1842ea6ec48b944fc661530adba
Size

480KB
Sample

230506-zzv1qaeg54
MD5

a0d4bbdca63319cce72f1f829898efae
SHA1

184f372ffb4766b8fd98616ad4b6ee3cefb85279
SHA256

2df1281b92cda25e162adf8cff728037f97eb1842ea6ec48b944fc661530adba
SHA512

b7f730ee5d7cd2c40369b5b20fd9c8512663031c042e39ad1ee9d6049972207d9ddd57e0bdfb034d75026fc7fe9e1e392f7f1c39b1a15693d23befbeda3bae7b
SSDEEP

12288:RMr+y901M5zY+BFbag3PnNVKy5qenmjsM+h:LycM5NJ3PbrmjsM+h

Score

10^/10

redline infostealer persistence stealer

Malware Config

Targets

- Target
  
  2df1281b92cda25e162adf8cff728037f97eb1842ea6ec48b944fc661530adba
- Size
  
  480KB
- MD5
  
  a0d4bbdca63319cce72f1f829898efae
- SHA1
  
  184f372ffb4766b8fd98616ad4b6ee3cefb85279
- SHA256
  
  2df1281b92cda25e162adf8cff728037f97eb1842ea6ec48b944fc661530adba
- SHA512
  
  b7f730ee5d7cd2c40369b5b20fd9c8512663031c042e39ad1ee9d6049972207d9ddd57e0bdfb034d75026fc7fe9e1e392f7f1c39b1a15693d23befbeda3bae7b
- SSDEEP
  
  12288:RMr+y901M5zY+BFbag3PnNVKy5qenmjsM+h:LycM5NJ3PbrmjsM+h
Score

10^/10

persistence redline infostealer stealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

redlineinfostealerpersistencestealer