YARA-Regeln für RedLine
15 Regeln aus 8 Quellen erkennen RedLine. Sortiert nach YARA-X-Kompatibilität, Lizenz (Volltext zuerst), Score und Qualität. Überwiegend: Malware, Verdächtig / Hunting.
Die Gruppierung nach Familie ist heuristisch: Prüfen Sie die Beschreibung jeder Regel.
Dateien mit allen RedLine-Regeln scannenRegeln suchen
Matches rare strings found in Redline panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Matches prompt messages in Redline panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Matches error/success messages in Redline panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Matches view headers in Redline Panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Finds Redline samples based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-09-07Bytecodes found in late 2023 Redline malware
MalwareEmbee Research· Matthew @ Embee_Research· 2023-08-27Patterns observed in redline loader
MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24Patterns observed in redline
MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24Configuration related bytecodes in redline .net files
MalwareEmbee Research· Matthew @ Embee_Research· 2023-10-11Detects typical stealer output files as created by RedLine or Racoon stealer
Verdächtig / HuntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-09-17Rule to detect the RedLine payload
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-16Detects native packer stub for version 4.5-4.7 of .NET Reactor. A pirated copy of version 4.5 of this commercial obfuscation solution is used by various malware families like BlackBit, RedLine, AgentTesla etc.
Verdächtig / HuntingCod3nym detection-rules· Jonathan Peters· 2024-01-05- ARKBIRD_SOLG_Mal_Stealer_NET_Redline_Aug_2020_1Nur Metadaten
Detect Redline Stealer (August 2020)
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-08-24 - SECUINFRA_MAL_Redline_Certificate_BoschNur Metadaten
Detects Certificate used by Redline Stealer
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02 - SECUINFRA_MAL_Redline_Certificate_GeforceNur Metadaten
Detects Certificate used by Redline Stealer
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-13