General
-
Target
6f6bbcc03bc05696801cbe339531f2277e2e26d347341ed71713555cb36375f3
-
Size
1.0MB
-
Sample
241104-qpw1la1bkk
-
MD5
29db78995f19db2519553217e1c9fd36
-
SHA1
2d75b5cd2f68948ea13ddd7333090d772bb66c8e
-
SHA256
6f6bbcc03bc05696801cbe339531f2277e2e26d347341ed71713555cb36375f3
-
SHA512
9ac7fcdda7fcabfac67e7a645cb089d3f61491220a578ba9446b73e442d27b90597e3d33d0f817db3869549cd9cff17b02ab4beb66d43d38834bf6e1a8c15535
-
SSDEEP
24576:IynzkqxXWVw1/rtl07izluGXLn2xYNL8PFnmmy4crUmrNdk:PnlmVMrtl0Gu+26L8PFnml4Jm3
Static task
static1
Behavioral task
behavioral1
Sample
6f6bbcc03bc05696801cbe339531f2277e2e26d347341ed71713555cb36375f3.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
ramon
193.233.20.23:4123
-
auth_value
3197576965d9513f115338c233015b40
Targets
-
-
Target
6f6bbcc03bc05696801cbe339531f2277e2e26d347341ed71713555cb36375f3
-
Size
1.0MB
-
MD5
29db78995f19db2519553217e1c9fd36
-
SHA1
2d75b5cd2f68948ea13ddd7333090d772bb66c8e
-
SHA256
6f6bbcc03bc05696801cbe339531f2277e2e26d347341ed71713555cb36375f3
-
SHA512
9ac7fcdda7fcabfac67e7a645cb089d3f61491220a578ba9446b73e442d27b90597e3d33d0f817db3869549cd9cff17b02ab4beb66d43d38834bf6e1a8c15535
-
SSDEEP
24576:IynzkqxXWVw1/rtl07izluGXLn2xYNL8PFnmmy4crUmrNdk:PnlmVMrtl0Gu+26L8PFnml4Jm3
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1