redline

Resubmissions

29-10-2024 14:06

241029-regnlawcqp 10

29-10-2024 12:53

241029-p4zvcsvhqp 10

07-05-2023 04:57

230507-fldpqshh67 10

Sharing

Copy URL

Twitter E-mail

General

Target

9b7ba8dd0178eee5df00dcee5be7694514faead9a273fb3fd7bc6d532d750e66
Size

746KB
Sample

230507-fldpqshh67
MD5

7c3dda2c9904ba420260b3489e2ef165
SHA1

c5ce5096c8d8175ff522ee68d1a68b8cea926c2d
SHA256

9b7ba8dd0178eee5df00dcee5be7694514faead9a273fb3fd7bc6d532d750e66
SHA512

2f10af6e5d497478f47813322d039012467c43d4bba12fe30b5a42a472379c9daa62529c73657d77886c5b8fcaab9cae959e5264124cec750091b0d9a237febd
SSDEEP

12288:Sy90N8arEZ38DLXqXNNsbiuQ4sbrXfUcXfSqXtXVtCX3b73xzR:Sy48arEJYLa9eenX8cXfVSb7/

Score

10^/10

Malware Config

Targets

- Target
  
  9b7ba8dd0178eee5df00dcee5be7694514faead9a273fb3fd7bc6d532d750e66
- Size
  
  746KB
- MD5
  
  7c3dda2c9904ba420260b3489e2ef165
- SHA1
  
  c5ce5096c8d8175ff522ee68d1a68b8cea926c2d
- SHA256
  
  9b7ba8dd0178eee5df00dcee5be7694514faead9a273fb3fd7bc6d532d750e66
- SHA512
  
  2f10af6e5d497478f47813322d039012467c43d4bba12fe30b5a42a472379c9daa62529c73657d77886c5b8fcaab9cae959e5264124cec750091b0d9a237febd
- SSDEEP
  
  12288:Sy90N8arEZ38DLXqXNNsbiuQ4sbrXfUcXfSqXtXVtCX3b73xzR:Sy48arEJYLa9eenX8cXfVSb7/
Score

10^/10

evasion persistence trojan redline infostealer stealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Detects Redline Stealer samples

Modifies Windows Defender Real-time Protection settings

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2