General
-
Target
fe85520c2d97cce594dd0d6da42162284554c5d501f4c50cd2a37c6708c9a6cf
-
Size
1.5MB
-
Sample
230507-kw42wscg89
-
MD5
06c49a40cde38474e581fe8196c97144
-
SHA1
f51d89725de428ac98e99058b1196398617889ec
-
SHA256
fe85520c2d97cce594dd0d6da42162284554c5d501f4c50cd2a37c6708c9a6cf
-
SHA512
728e092ea4d12203e7417cedfb409e5884337f8966e6c119f08c752e59bff9876b566b5074d0a54a356cca4678ef0a3f41735bac70770bce07f73c8d86afcc95
-
SSDEEP
24576:6y4w1qBXlgNPrt/ernl6VRL8tg+m7+MYmZfpHVlS6rQZsNHOmm5jAltG0I5QyFvu:B4wglaz/EQVJAuYmVpHDTrQaup9AlkFN
Static task
static1
Behavioral task
behavioral1
Sample
fe85520c2d97cce594dd0d6da42162284554c5d501f4c50cd2a37c6708c9a6cf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fe85520c2d97cce594dd0d6da42162284554c5d501f4c50cd2a37c6708c9a6cf.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
most
185.161.248.73:4164
-
auth_value
7da4dfa153f2919e617aa016f7c36008
Targets
-
-
Target
fe85520c2d97cce594dd0d6da42162284554c5d501f4c50cd2a37c6708c9a6cf
-
Size
1.5MB
-
MD5
06c49a40cde38474e581fe8196c97144
-
SHA1
f51d89725de428ac98e99058b1196398617889ec
-
SHA256
fe85520c2d97cce594dd0d6da42162284554c5d501f4c50cd2a37c6708c9a6cf
-
SHA512
728e092ea4d12203e7417cedfb409e5884337f8966e6c119f08c752e59bff9876b566b5074d0a54a356cca4678ef0a3f41735bac70770bce07f73c8d86afcc95
-
SSDEEP
24576:6y4w1qBXlgNPrt/ernl6VRL8tg+m7+MYmZfpHVlS6rQZsNHOmm5jAltG0I5QyFvu:B4wglaz/EQVJAuYmVpHDTrQaup9AlkFN
Score10/10-
Detects Redline Stealer samples
This rule detects the presence of Redline Stealer samples based on their unique strings.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-