General
-
Target
bd4db20a91bd64c0ca6817c8ca3a7325dc40f5c571b604b9df1f66667c88471fexe_JC.exe
-
Size
517KB
-
Sample
230810-w94ttsge35
-
MD5
f39abb0c33bb5208869d2a011f57be67
-
SHA1
3556528fd097529cb0c8df02cd719b1ffd821088
-
SHA256
bd4db20a91bd64c0ca6817c8ca3a7325dc40f5c571b604b9df1f66667c88471f
-
SHA512
3f78a2f70d393891467df835967b6ac72d3d588cf0471621e2a09c76ef87407d02b9b37fe082416485828ee2cab565ecf410ad4167a4a4d4f7092fcabadcd24a
-
SSDEEP
12288:NMrjy90iR/rBFDu28HMP/ABph4L0trSP3Y1S2wiqTR:iyxDBJoMP/FpVR
Static task
static1
Behavioral task
behavioral1
Sample
bd4db20a91bd64c0ca6817c8ca3a7325dc40f5c571b604b9df1f66667c88471fexe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
bd4db20a91bd64c0ca6817c8ca3a7325dc40f5c571b604b9df1f66667c88471fexe_JC.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
amadey
3.86
77.91.68.61/rock/index.php
Extracted
redline
papik
77.91.124.156:19071
-
auth_value
325a615d8be5db8e2f7a4c2448fdac3a
Targets
-
-
Target
bd4db20a91bd64c0ca6817c8ca3a7325dc40f5c571b604b9df1f66667c88471fexe_JC.exe
-
Size
517KB
-
MD5
f39abb0c33bb5208869d2a011f57be67
-
SHA1
3556528fd097529cb0c8df02cd719b1ffd821088
-
SHA256
bd4db20a91bd64c0ca6817c8ca3a7325dc40f5c571b604b9df1f66667c88471f
-
SHA512
3f78a2f70d393891467df835967b6ac72d3d588cf0471621e2a09c76ef87407d02b9b37fe082416485828ee2cab565ecf410ad4167a4a4d4f7092fcabadcd24a
-
SSDEEP
12288:NMrjy90iR/rBFDu28HMP/ABph4L0trSP3Y1S2wiqTR:iyxDBJoMP/FpVR
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1