General
-
Target
ce621d2f070ddecdd131dbb7506aa34fc688e00be16d463510af7edd20b17391
-
Size
1.2MB
-
Sample
230507-hr9epsbg26
-
MD5
eee951f94cb69464e43c6d8ed4cd8a72
-
SHA1
b8af330a5a0e9a87cd7c52e271b23d9b03637801
-
SHA256
ce621d2f070ddecdd131dbb7506aa34fc688e00be16d463510af7edd20b17391
-
SHA512
5272a267ffce4c122bcd8f1daafa1edbd6d2b0cde4420074ca15727ded8be1f283ac041fd6d70c232681ac0fc4be7e52b7c080ebf5790b6548c51fa57050b2bd
-
SSDEEP
24576:+ySoHtYy3Z7KM4nzDLo0WTDF1Hk6Pe74gonji9LJjiT1yJfkToISbxj:NSvJnzXo0KDO4goYLwT1yJfooI
Static task
static1
Behavioral task
behavioral1
Sample
ce621d2f070ddecdd131dbb7506aa34fc688e00be16d463510af7edd20b17391.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ce621d2f070ddecdd131dbb7506aa34fc688e00be16d463510af7edd20b17391.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lisa
185.161.248.73:4164
-
auth_value
c2dc311db9820012377b054447d37949
Targets
-
-
Target
ce621d2f070ddecdd131dbb7506aa34fc688e00be16d463510af7edd20b17391
-
Size
1.2MB
-
MD5
eee951f94cb69464e43c6d8ed4cd8a72
-
SHA1
b8af330a5a0e9a87cd7c52e271b23d9b03637801
-
SHA256
ce621d2f070ddecdd131dbb7506aa34fc688e00be16d463510af7edd20b17391
-
SHA512
5272a267ffce4c122bcd8f1daafa1edbd6d2b0cde4420074ca15727ded8be1f283ac041fd6d70c232681ac0fc4be7e52b7c080ebf5790b6548c51fa57050b2bd
-
SSDEEP
24576:+ySoHtYy3Z7KM4nzDLo0WTDF1Hk6Pe74gonji9LJjiT1yJfkToISbxj:NSvJnzXo0KDO4goYLwT1yJfooI
-
Detects Redline Stealer samples
This rule detects the presence of Redline Stealer samples based on their unique strings.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-