Resubmissions

29-10-2024 12:13

241029-pdwd9avgkq 10

07-05-2023 01:09

230507-bhsx2afe99 10

General

  • Target

    3a233b98bc1a4f358b848e143e0b5cb8e310eba5e35b453adbbd17106552d163.bin

  • Size

    702KB

  • Sample

    230507-bhsx2afe99

  • MD5

    38917df14930c01c2cd9bc5724c1a21a

  • SHA1

    b308686e0427e2b19c2de8a9e1700396af3f1455

  • SHA256

    3a233b98bc1a4f358b848e143e0b5cb8e310eba5e35b453adbbd17106552d163

  • SHA512

    c4f29ef38a836553267744033d2a98358e7dacc0353aaf677c7e47eeb0eec2cd0b2d3c91c9edb9482c5ffcd686f6bd260c502129076cf2dd21d796cbbcc04b50

  • SSDEEP

    12288:Zy90NwK/g2JW8gleN9r3BQk0j8cbXUGF18iWfEG2Qo9w+6ECdXIMttG6:Zy3uJW1eBN46cGiwdXiMttG6

Malware Config

Targets

    • Target

      3a233b98bc1a4f358b848e143e0b5cb8e310eba5e35b453adbbd17106552d163.bin

    • Size

      702KB

    • MD5

      38917df14930c01c2cd9bc5724c1a21a

    • SHA1

      b308686e0427e2b19c2de8a9e1700396af3f1455

    • SHA256

      3a233b98bc1a4f358b848e143e0b5cb8e310eba5e35b453adbbd17106552d163

    • SHA512

      c4f29ef38a836553267744033d2a98358e7dacc0353aaf677c7e47eeb0eec2cd0b2d3c91c9edb9482c5ffcd686f6bd260c502129076cf2dd21d796cbbcc04b50

    • SSDEEP

      12288:Zy90NwK/g2JW8gleN9r3BQk0j8cbXUGF18iWfEG2Qo9w+6ECdXIMttG6:Zy3uJW1eBN46cGiwdXiMttG6

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks