General
-
Target
ff953db8aa0a8d1e7a4c5bc8859a8a519ff2d4f8f6cbbb24289b198d62d76155
-
Size
1.5MB
-
Sample
230507-ky1r9aeg8t
-
MD5
2a2216b605e12dcd36c580688eaa81e7
-
SHA1
35bf6a2abf0410f0b21ed318f7268cf0f4f57ced
-
SHA256
ff953db8aa0a8d1e7a4c5bc8859a8a519ff2d4f8f6cbbb24289b198d62d76155
-
SHA512
442d967593ce0ea07b91d723b082851707dac15433c9e93715b72d08caed0c0ed4613eba8c46c862725907aa34afda2c822235d65ba73056a92bf758b24679c2
-
SSDEEP
24576:syt4JIJoKJsJ+PMz+eI7i8hEr6YhS/x3Xs77GhHoqLsKaKW+i3QtWMMLlpaqJK9z:btYko8PMVCih2n/xns7CBraCigtyLlpd
Static task
static1
Behavioral task
behavioral1
Sample
ff953db8aa0a8d1e7a4c5bc8859a8a519ff2d4f8f6cbbb24289b198d62d76155.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ff953db8aa0a8d1e7a4c5bc8859a8a519ff2d4f8f6cbbb24289b198d62d76155.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
most
185.161.248.73:4164
-
auth_value
7da4dfa153f2919e617aa016f7c36008
Targets
-
-
Target
ff953db8aa0a8d1e7a4c5bc8859a8a519ff2d4f8f6cbbb24289b198d62d76155
-
Size
1.5MB
-
MD5
2a2216b605e12dcd36c580688eaa81e7
-
SHA1
35bf6a2abf0410f0b21ed318f7268cf0f4f57ced
-
SHA256
ff953db8aa0a8d1e7a4c5bc8859a8a519ff2d4f8f6cbbb24289b198d62d76155
-
SHA512
442d967593ce0ea07b91d723b082851707dac15433c9e93715b72d08caed0c0ed4613eba8c46c862725907aa34afda2c822235d65ba73056a92bf758b24679c2
-
SSDEEP
24576:syt4JIJoKJsJ+PMz+eI7i8hEr6YhS/x3Xs77GhHoqLsKaKW+i3QtWMMLlpaqJK9z:btYko8PMVCih2n/xns7CBraCigtyLlpd
Score10/10-
Detects Redline Stealer samples
This rule detects the presence of Redline Stealer samples based on their unique strings.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-