Règles YARA pour RedLine
15 règles issues de 8 sources détectent RedLine. Elles sont classées par compatibilité YARA-X, licence (texte complet d’abord), score et qualité. Principalement : Malware, Suspect / chasse.
Le regroupement par famille est heuristique : vérifiez la description de chaque règle.
Scanner des fichiers avec toutes les règles RedLineRechercher des règles
Matches rare strings found in Redline panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Matches prompt messages in Redline panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Matches error/success messages in Redline panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Matches view headers in Redline Panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Finds Redline samples based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-09-07Bytecodes found in late 2023 Redline malware
MalwareEmbee Research· Matthew @ Embee_Research· 2023-08-27Patterns observed in redline loader
MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24Patterns observed in redline
MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24Configuration related bytecodes in redline .net files
MalwareEmbee Research· Matthew @ Embee_Research· 2023-10-11Detects typical stealer output files as created by RedLine or Racoon stealer
Suspect / chasseSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-09-17Rule to detect the RedLine payload
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-16Detects native packer stub for version 4.5-4.7 of .NET Reactor. A pirated copy of version 4.5 of this commercial obfuscation solution is used by various malware families like BlackBit, RedLine, AgentTesla etc.
Suspect / chasseCod3nym detection-rules· Jonathan Peters· 2024-01-05- ARKBIRD_SOLG_Mal_Stealer_NET_Redline_Aug_2020_1Métadonnées seules
Detect Redline Stealer (August 2020)
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-08-24 - SECUINFRA_MAL_Redline_Certificate_BoschMétadonnées seules
Detects Certificate used by Redline Stealer
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02 - SECUINFRA_MAL_Redline_Certificate_GeforceMétadonnées seules
Detects Certificate used by Redline Stealer
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-13