General
-
Target
4c3e756c296fe51f09db6262f73795b00a7b3553e2636ecf747dbda65e8fecd7
-
Size
686KB
-
Sample
241104-zqlqpawpbz
-
MD5
347c5c0b95a74ea5a1c2e4d8c78d37aa
-
SHA1
287cd199541e9048b3a918f0729edd220226bbf0
-
SHA256
4c3e756c296fe51f09db6262f73795b00a7b3553e2636ecf747dbda65e8fecd7
-
SHA512
6864fa1835781a7e7791705ec8674729a42f3302ebeef946a1d0a906910c6ce6595de3d3c1cc1af540e8deb8dfb1ca30384b93a60800fc29f4d3c4e5f2ccdf3c
-
SSDEEP
12288:KMr8y90cUaSnvyab4LU0t2O2vfV7LQrvA7VTIiniFq9lcV+bDH:KyrWvyaYU+2vfV7kfIiFq9lTH
Static task
static1
Behavioral task
behavioral1
Sample
4c3e756c296fe51f09db6262f73795b00a7b3553e2636ecf747dbda65e8fecd7.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Targets
-
-
Target
4c3e756c296fe51f09db6262f73795b00a7b3553e2636ecf747dbda65e8fecd7
-
Size
686KB
-
MD5
347c5c0b95a74ea5a1c2e4d8c78d37aa
-
SHA1
287cd199541e9048b3a918f0729edd220226bbf0
-
SHA256
4c3e756c296fe51f09db6262f73795b00a7b3553e2636ecf747dbda65e8fecd7
-
SHA512
6864fa1835781a7e7791705ec8674729a42f3302ebeef946a1d0a906910c6ce6595de3d3c1cc1af540e8deb8dfb1ca30384b93a60800fc29f4d3c4e5f2ccdf3c
-
SSDEEP
12288:KMr8y90cUaSnvyab4LU0t2O2vfV7LQrvA7VTIiniFq9lcV+bDH:KyrWvyaYU+2vfV7kfIiFq9lTH
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1