General
-
Target
a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exe
-
Size
517KB
-
Sample
230809-vn8p8afc2z
-
MD5
7a4c7e87293811a73f42e7f92c0b8316
-
SHA1
a6f9a80112901db5a316a8c5cbda717651b02141
-
SHA256
a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdf
-
SHA512
f0080c8654d53068672fedf5dc68b4cca4e19930369de9546bbc242ebb85f4b7fdaadb8bbd25723d2c242eadd0b8f27d4d4ae1884aab8c1be6e8e381547b906d
-
SSDEEP
6144:K9y+bnr+zp0yN90QEhf1lsLhCm6G2QkI/lcqmMitHw6xCnijn0IQVJHZVzI2fzBG:vMrny90b1ikw2QPqwtij0bVJ5Vrr/c
Static task
static1
Behavioral task
behavioral1
Sample
a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
amadey
3.86
5.42.92.67/norm/index.php
Extracted
redline
papik
77.91.124.156:19071
-
auth_value
325a615d8be5db8e2f7a4c2448fdac3a
Targets
-
-
Target
a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exe
-
Size
517KB
-
MD5
7a4c7e87293811a73f42e7f92c0b8316
-
SHA1
a6f9a80112901db5a316a8c5cbda717651b02141
-
SHA256
a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdf
-
SHA512
f0080c8654d53068672fedf5dc68b4cca4e19930369de9546bbc242ebb85f4b7fdaadb8bbd25723d2c242eadd0b8f27d4d4ae1884aab8c1be6e8e381547b906d
-
SSDEEP
6144:K9y+bnr+zp0yN90QEhf1lsLhCm6G2QkI/lcqmMitHw6xCnijn0IQVJHZVzI2fzBG:vMrny90b1ikw2QPqwtij0bVJ5Vrr/c
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1