General
-
Target
e9683a1eec28598de450144500d126b5baa95efbb4a2f70626e6d6d75deac064
-
Size
662KB
-
Sample
241105-2sxl3ssrcn
-
MD5
15682a13d51c2dab43f9315eb761454d
-
SHA1
2f769b3b30fec07bbb64c450f2781cc93d3d41f5
-
SHA256
e9683a1eec28598de450144500d126b5baa95efbb4a2f70626e6d6d75deac064
-
SHA512
8a2ff76bd4ad90e7a904700734fd46530c57daa91da60139367dde34d32ec96d15f4cd476b75c802912a5a270053a1f81d3acc6a2527b7c30a3fd3625df86ac4
-
SSDEEP
12288:rMrPy90qbUyxudDvTsU27KRvAcCMeEB3BJkJL2q5xogmWk:0yYjQrgFCMeEhkJL2q5qgmr
Static task
static1
Behavioral task
behavioral1
Sample
e9683a1eec28598de450144500d126b5baa95efbb4a2f70626e6d6d75deac064.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Targets
-
-
Target
e9683a1eec28598de450144500d126b5baa95efbb4a2f70626e6d6d75deac064
-
Size
662KB
-
MD5
15682a13d51c2dab43f9315eb761454d
-
SHA1
2f769b3b30fec07bbb64c450f2781cc93d3d41f5
-
SHA256
e9683a1eec28598de450144500d126b5baa95efbb4a2f70626e6d6d75deac064
-
SHA512
8a2ff76bd4ad90e7a904700734fd46530c57daa91da60139367dde34d32ec96d15f4cd476b75c802912a5a270053a1f81d3acc6a2527b7c30a3fd3625df86ac4
-
SSDEEP
12288:rMrPy90qbUyxudDvTsU27KRvAcCMeEB3BJkJL2q5xogmWk:0yYjQrgFCMeEhkJL2q5qgmr
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1