General
-
Target
8cf9ccd6da36205ee83da0b0a5e7f6cc91d5bf077df572fab6e7109ae76cd4d9
-
Size
478KB
-
Sample
240510-ad176sfa4w
-
MD5
56cbda6826023f3af9c6781e81eb5eb2
-
SHA1
da2db737b6856bd7495fd7f4965f1ad7c1608c35
-
SHA256
8cf9ccd6da36205ee83da0b0a5e7f6cc91d5bf077df572fab6e7109ae76cd4d9
-
SHA512
98230f7393443acef809e5696e74cd194dd63cfbbb5d7cb3b8751d19d0ddc991299da2809cc4462249cc4b3c1ef578b6be44e5b79a87ae6dd8bb4b26bd571316
-
SSDEEP
12288:CMrmy905CjTVLGuS5c1u31pTHoaPH+yvN5GOMU:gyB5Lj2XTTI8+iNUy
Static task
static1
Behavioral task
behavioral1
Sample
8cf9ccd6da36205ee83da0b0a5e7f6cc91d5bf077df572fab6e7109ae76cd4d9.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
redline
dumud
217.196.96.101:4132
-
auth_value
3e18d4b90418aa3e78d8822e87c62f5c
Targets
-
-
Target
8cf9ccd6da36205ee83da0b0a5e7f6cc91d5bf077df572fab6e7109ae76cd4d9
-
Size
478KB
-
MD5
56cbda6826023f3af9c6781e81eb5eb2
-
SHA1
da2db737b6856bd7495fd7f4965f1ad7c1608c35
-
SHA256
8cf9ccd6da36205ee83da0b0a5e7f6cc91d5bf077df572fab6e7109ae76cd4d9
-
SHA512
98230f7393443acef809e5696e74cd194dd63cfbbb5d7cb3b8751d19d0ddc991299da2809cc4462249cc4b3c1ef578b6be44e5b79a87ae6dd8bb4b26bd571316
-
SSDEEP
12288:CMrmy905CjTVLGuS5c1u31pTHoaPH+yvN5GOMU:gyB5Lj2XTTI8+iNUy
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
-
Detects executables packed with ConfuserEx Mod
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1