General
-
Target
5b8e229cd4eb438b16c2b518ea9dc74b6e0aa00c1a522c7c0115acc60549e6b1
-
Size
563KB
-
Sample
241104-13s6zaxqas
-
MD5
f6bcc1169d386aff9b82bc5107f4dff8
-
SHA1
6d20b207a72f8c33556d4f7b53b02a846d121009
-
SHA256
5b8e229cd4eb438b16c2b518ea9dc74b6e0aa00c1a522c7c0115acc60549e6b1
-
SHA512
898d824353c798192031c705af62232dc157f65b51847be757b8e74a421285fe484ea3141e4cc5b01b7fffb7a17215244aab6f51091444bae788d93142ab3014
-
SSDEEP
12288:ly909bwwETzDg7EBoY+lHrEfFpxQK0rEearIMtba9Ad:ly+bwXDg7ZP5rEfHxUv0IMtba0
Static task
static1
Behavioral task
behavioral1
Sample
5b8e229cd4eb438b16c2b518ea9dc74b6e0aa00c1a522c7c0115acc60549e6b1.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
5b8e229cd4eb438b16c2b518ea9dc74b6e0aa00c1a522c7c0115acc60549e6b1
-
Size
563KB
-
MD5
f6bcc1169d386aff9b82bc5107f4dff8
-
SHA1
6d20b207a72f8c33556d4f7b53b02a846d121009
-
SHA256
5b8e229cd4eb438b16c2b518ea9dc74b6e0aa00c1a522c7c0115acc60549e6b1
-
SHA512
898d824353c798192031c705af62232dc157f65b51847be757b8e74a421285fe484ea3141e4cc5b01b7fffb7a17215244aab6f51091444bae788d93142ab3014
-
SSDEEP
12288:ly909bwwETzDg7EBoY+lHrEfFpxQK0rEearIMtba9Ad:ly+bwXDg7ZP5rEfHxUv0IMtba0
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1