General
-
Target
16016b7ca0208c2af4ae943a9450fd9cd888d0209becb95b7d64340bb0c914e3
-
Size
561KB
-
Sample
230807-qrx1nsfe45
-
MD5
892d128ed8832e7eab6d6054239e067e
-
SHA1
19c1dd621f7ab1f171279b94f18ea1fa55cbd734
-
SHA256
16016b7ca0208c2af4ae943a9450fd9cd888d0209becb95b7d64340bb0c914e3
-
SHA512
ce35ec5e6c83ac45f1e36dca4b0a59823bb616d01eb35587228d024c8f3bbea22aca906f68a8d4b3c0605776230517bebf044aaf159ab4f47598e1dbf0c5f97b
-
SSDEEP
12288:FMrky90au6H4OibfCyFMJ65bjI7ZqyJ2GuXyMFAi5TcqPh:ZyTF6bf8QJyqXyAAKT5
Static task
static1
Behavioral task
behavioral1
Sample
16016b7ca0208c2af4ae943a9450fd9cd888d0209becb95b7d64340bb0c914e3.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
dodge
77.91.124.156:19071
-
auth_value
3372223e987be2a16148c072df30163d
Extracted
systembc
ar.undata.cc:5320
ar1.undata.cc:5320
Targets
-
-
Target
16016b7ca0208c2af4ae943a9450fd9cd888d0209becb95b7d64340bb0c914e3
-
Size
561KB
-
MD5
892d128ed8832e7eab6d6054239e067e
-
SHA1
19c1dd621f7ab1f171279b94f18ea1fa55cbd734
-
SHA256
16016b7ca0208c2af4ae943a9450fd9cd888d0209becb95b7d64340bb0c914e3
-
SHA512
ce35ec5e6c83ac45f1e36dca4b0a59823bb616d01eb35587228d024c8f3bbea22aca906f68a8d4b3c0605776230517bebf044aaf159ab4f47598e1dbf0c5f97b
-
SSDEEP
12288:FMrky90au6H4OibfCyFMJ65bjI7ZqyJ2GuXyMFAi5TcqPh:ZyTF6bf8QJyqXyAAKT5
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1