General
-
Target
8c0ff2fb8cc0e770416723219e439bf3a4f5c65f8a8b3437c2315960b6ed0355
-
Size
1.2MB
-
Sample
231013-fcq9gaec6s
-
MD5
18e03b7a2838fe5a0495668c2194a5e4
-
SHA1
a530131837946bcb471104c5da00aeef94fe7caf
-
SHA256
8c0ff2fb8cc0e770416723219e439bf3a4f5c65f8a8b3437c2315960b6ed0355
-
SHA512
f70243ed9326f43491a963243c9761f896ace556209351df390688ffc11864a9c7602b57b39118136cbd9d0f7faac6c39361b6f160dc7770f57229859b7d87c8
-
SSDEEP
24576:W74crqJ5uXtSAwl7vIpJz10UdITShGIgWbPvsvLLlyDpmq+G:M4crqfu9zYbeJRjCeh/6LADpmq+G
Static task
static1
Behavioral task
behavioral1
Sample
8c0ff2fb8cc0e770416723219e439bf3a4f5c65f8a8b3437c2315960b6ed0355.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
8c0ff2fb8cc0e770416723219e439bf3a4f5c65f8a8b3437c2315960b6ed0355.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
redline
petin
77.91.124.82:19071
-
auth_value
f6cf7a48c0291d1ef5a3440429827d6d
Targets
-
-
Target
8c0ff2fb8cc0e770416723219e439bf3a4f5c65f8a8b3437c2315960b6ed0355
-
Size
1.2MB
-
MD5
18e03b7a2838fe5a0495668c2194a5e4
-
SHA1
a530131837946bcb471104c5da00aeef94fe7caf
-
SHA256
8c0ff2fb8cc0e770416723219e439bf3a4f5c65f8a8b3437c2315960b6ed0355
-
SHA512
f70243ed9326f43491a963243c9761f896ace556209351df390688ffc11864a9c7602b57b39118136cbd9d0f7faac6c39361b6f160dc7770f57229859b7d87c8
-
SSDEEP
24576:W74crqJ5uXtSAwl7vIpJz10UdITShGIgWbPvsvLLlyDpmq+G:M4crqfu9zYbeJRjCeh/6LADpmq+G
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1