General
-
Target
c362113d00b82bfc8c5fef2054fdf9eb63d12a307f49f031285cc68c5bc58101exe_JC.exe
-
Size
516KB
-
Sample
230811-sn9amsec27
-
MD5
d8ed2c588d448c8a591b4acbfb35b758
-
SHA1
a34c9d80de0759c2ca43c8428fabdf26dbaf0b6b
-
SHA256
c362113d00b82bfc8c5fef2054fdf9eb63d12a307f49f031285cc68c5bc58101
-
SHA512
acfd9a2dd7dc1038f82cabad68e3c0a5b6b30f5b545d4381cb13cb01d471fc4af599da7fe49729ca6fae22d785e52e4b320bd3b8aba14dd3b727bc83cd4c6e1d
-
SSDEEP
12288:6MrJy90cQJq2nWfKdAOxdITEZq0zpgd7w6W6cIvrHOR:zyWM2n92/2pgdE6nOR
Static task
static1
Behavioral task
behavioral1
Sample
c362113d00b82bfc8c5fef2054fdf9eb63d12a307f49f031285cc68c5bc58101exe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
c362113d00b82bfc8c5fef2054fdf9eb63d12a307f49f031285cc68c5bc58101exe_JC.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
amadey
3.86
77.91.68.61/rock/index.php
Extracted
redline
papik
77.91.124.156:19071
-
auth_value
325a615d8be5db8e2f7a4c2448fdac3a
Targets
-
-
Target
c362113d00b82bfc8c5fef2054fdf9eb63d12a307f49f031285cc68c5bc58101exe_JC.exe
-
Size
516KB
-
MD5
d8ed2c588d448c8a591b4acbfb35b758
-
SHA1
a34c9d80de0759c2ca43c8428fabdf26dbaf0b6b
-
SHA256
c362113d00b82bfc8c5fef2054fdf9eb63d12a307f49f031285cc68c5bc58101
-
SHA512
acfd9a2dd7dc1038f82cabad68e3c0a5b6b30f5b545d4381cb13cb01d471fc4af599da7fe49729ca6fae22d785e52e4b320bd3b8aba14dd3b727bc83cd4c6e1d
-
SSDEEP
12288:6MrJy90cQJq2nWfKdAOxdITEZq0zpgd7w6W6cIvrHOR:zyWM2n92/2pgdE6nOR
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1