redline | c33a121a0a51f5538be4a3649f7c8d7f2965e5090f83d19030f56d7fbea07fea | Triage

Resubmissions

29-10-2024 12:54

241029-p48ghawqgq 10

07-05-2023 06:34

230507-hb2pxsbd61 10

Sharing

General

Target

c33a121a0a51f5538be4a3649f7c8d7f2965e5090f83d19030f56d7fbea07fea
Size

1.2MB
Sample

230507-hb2pxsbd61
MD5

d29f991dff39fe56501f4e530f57f9fc
SHA1

33613d88ffee18ce6240032e9134a1ca25e71832
SHA256

c33a121a0a51f5538be4a3649f7c8d7f2965e5090f83d19030f56d7fbea07fea
SHA512

bf9cf8a6e827986d52d49f31995aaa9b40fbfbbafb3624bd0dfe28c72cd1338bfab4e35e8c123c7fba13ce38b79bec6eb59b14c2ac89d934e8a8fb9780d4e581
SSDEEP

24576:G8WP6XlIJGBLj1k9E8MK2MipAlFlQoqIhtjrzPnd+DHfsYbvtwgq:goqJG9d8knqlQoqIzPd8Hfsgvn

Score

10^/10

redline evasion infostealer persistence stealer trojan

Malware Config

Targets

- Target
  
  c33a121a0a51f5538be4a3649f7c8d7f2965e5090f83d19030f56d7fbea07fea
- Size
  
  1.2MB
- MD5
  
  d29f991dff39fe56501f4e530f57f9fc
- SHA1
  
  33613d88ffee18ce6240032e9134a1ca25e71832
- SHA256
  
  c33a121a0a51f5538be4a3649f7c8d7f2965e5090f83d19030f56d7fbea07fea
- SHA512
  
  bf9cf8a6e827986d52d49f31995aaa9b40fbfbbafb3624bd0dfe28c72cd1338bfab4e35e8c123c7fba13ce38b79bec6eb59b14c2ac89d934e8a8fb9780d4e581
- SSDEEP
  
  24576:G8WP6XlIJGBLj1k9E8MK2MipAlFlQoqIhtjrzPnd+DHfsYbvtwgq:goqJG9d8knqlQoqIzPd8Hfsgvn
Score

10^/10

evasion persistence trojan redline infostealer stealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

redlineevasioninfostealerpersistencestealertrojan