General
-
Target
221387b0312cfe3ddd5ef6388fed37bc78b0510aa4182f348d9d100eea03c867
-
Size
390KB
-
Sample
230718-v37rgacg52
-
MD5
6e8a89d3b863a858f8093c8d67bc2064
-
SHA1
5fe1b7ce3bce10f035d561866a99566d5fc40e9a
-
SHA256
221387b0312cfe3ddd5ef6388fed37bc78b0510aa4182f348d9d100eea03c867
-
SHA512
e9582c4d1337596a4ca70162b1e699b219ca5b4187f5f4b70238b2ae2c42d5cf27d401e2a403a0d4ccc0d4bfc8180286971e67e850d855d97d26fe7aaf5a8eb5
-
SSDEEP
12288:EMr8y90CCaZBWfY5ibPuKifHJcHnl9Dmo6i5y:4yZdZccibPuKif+Hv/6Ky
Static task
static1
Behavioral task
behavioral1
Sample
221387b0312cfe3ddd5ef6388fed37bc78b0510aa4182f348d9d100eea03c867.exe
Resource
win10-20230703-en
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
roma
77.91.68.56:19071
-
auth_value
f099c2cf92834dbc554a94e1456cf576
Targets
-
-
Target
221387b0312cfe3ddd5ef6388fed37bc78b0510aa4182f348d9d100eea03c867
-
Size
390KB
-
MD5
6e8a89d3b863a858f8093c8d67bc2064
-
SHA1
5fe1b7ce3bce10f035d561866a99566d5fc40e9a
-
SHA256
221387b0312cfe3ddd5ef6388fed37bc78b0510aa4182f348d9d100eea03c867
-
SHA512
e9582c4d1337596a4ca70162b1e699b219ca5b4187f5f4b70238b2ae2c42d5cf27d401e2a403a0d4ccc0d4bfc8180286971e67e850d855d97d26fe7aaf5a8eb5
-
SSDEEP
12288:EMr8y90CCaZBWfY5ibPuKifHJcHnl9Dmo6i5y:4yZdZccibPuKif+Hv/6Ky
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-