General
-
Target
55b4a82a129f7748e5dec22c943c83db81e6634240aef9139d491d856d41bce0
-
Size
666KB
-
Sample
241105-2pjwtazjgt
-
MD5
4572dc5cfa6d972825f4a5ffb85f2f6f
-
SHA1
18e214f8b21dc257c17588bb24d33d5b2d08afcf
-
SHA256
55b4a82a129f7748e5dec22c943c83db81e6634240aef9139d491d856d41bce0
-
SHA512
98d4d15ba7eac992f6ccde9d6de32860801ee55cf6aafe2661dd5f1aa87760fedf95ca1475609070eebfb0db610e3f69cb455fdb051d7c012a07d1cc141ba458
-
SSDEEP
12288:DMrEy9022vFJ57Pnq5BAyF0PQhqiNmqu0vAyWwrU/DH/wHv9Qe8crBcrgcr:fyr2vrc5dFJhlN1uWVrOfw1QzCmrd
Static task
static1
Behavioral task
behavioral1
Sample
55b4a82a129f7748e5dec22c943c83db81e6634240aef9139d491d856d41bce0.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Targets
-
-
Target
55b4a82a129f7748e5dec22c943c83db81e6634240aef9139d491d856d41bce0
-
Size
666KB
-
MD5
4572dc5cfa6d972825f4a5ffb85f2f6f
-
SHA1
18e214f8b21dc257c17588bb24d33d5b2d08afcf
-
SHA256
55b4a82a129f7748e5dec22c943c83db81e6634240aef9139d491d856d41bce0
-
SHA512
98d4d15ba7eac992f6ccde9d6de32860801ee55cf6aafe2661dd5f1aa87760fedf95ca1475609070eebfb0db610e3f69cb455fdb051d7c012a07d1cc141ba458
-
SSDEEP
12288:DMrEy9022vFJ57Pnq5BAyF0PQhqiNmqu0vAyWwrU/DH/wHv9Qe8crBcrgcr:fyr2vrc5dFJhlN1uWVrOfw1QzCmrd
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1