General
-
Target
4161d8ffe9d34a9762ac7a95295065611cd3cd4763ad3e5ae34b0277ac67a7e8
-
Size
517KB
-
Sample
230804-mt72wabf8x
-
MD5
c7bbc7e5b54afcc1f907ff85376689e6
-
SHA1
50a3ee96cfd474276f59b959a3e570f8446f6dbe
-
SHA256
4161d8ffe9d34a9762ac7a95295065611cd3cd4763ad3e5ae34b0277ac67a7e8
-
SHA512
5c1f615b64ce5f1e300b170b4348b75388ca7f20b45e2ba272cb833108ca6948f09af1939ee24142130bd2bf28bc77b705d5b141c5ed8127aaf615e14e583e9e
-
SSDEEP
12288:4Mrmzy90oGEWBQJeLXYhFp8NHHzxVjgBYC8D9mUrEA:Uylzp8NHHzfczWmUrEA
Static task
static1
Behavioral task
behavioral1
Sample
4161d8ffe9d34a9762ac7a95295065611cd3cd4763ad3e5ae34b0277ac67a7e8.exe
Resource
win10-20230703-en
Malware Config
Extracted
amadey
3.86
77.91.68.61/rock/index.php
Extracted
redline
maxik
77.91.124.156:19071
-
auth_value
a7714e1bc167c67e3fc8f9e368352269
Targets
-
-
Target
4161d8ffe9d34a9762ac7a95295065611cd3cd4763ad3e5ae34b0277ac67a7e8
-
Size
517KB
-
MD5
c7bbc7e5b54afcc1f907ff85376689e6
-
SHA1
50a3ee96cfd474276f59b959a3e570f8446f6dbe
-
SHA256
4161d8ffe9d34a9762ac7a95295065611cd3cd4763ad3e5ae34b0277ac67a7e8
-
SHA512
5c1f615b64ce5f1e300b170b4348b75388ca7f20b45e2ba272cb833108ca6948f09af1939ee24142130bd2bf28bc77b705d5b141c5ed8127aaf615e14e583e9e
-
SSDEEP
12288:4Mrmzy90oGEWBQJeLXYhFp8NHHzxVjgBYC8D9mUrEA:Uylzp8NHHzfczWmUrEA
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1