General
-
Target
f26ecc3bfbfc14f505e8af1afd15c613767c25d22eb9fb7527f5876be8533851
-
Size
1.1MB
-
Sample
241107-3jaxdszgna
-
MD5
b12ed9aeb866600a4f487b83a19283a3
-
SHA1
bfbabac6ef252bb8acca1acb4259b1dff8cbbb50
-
SHA256
f26ecc3bfbfc14f505e8af1afd15c613767c25d22eb9fb7527f5876be8533851
-
SHA512
225228c6aa204d954c37c6f2fab1c26058d1cc74228dedf7bb1a934ed38004cfe31dc88c8054544ac0068571985c5015ab5bd77a163af460e88c4aa74c3edbf2
-
SSDEEP
24576:7ybayeLpXQL+JddGRPxjgWZzxPg9drZOoga4992bJkGyAuTK0H:ubaRLtQL+Jdo+W/PodrMoi9AJDqW0
Static task
static1
Behavioral task
behavioral1
Sample
f26ecc3bfbfc14f505e8af1afd15c613767c25d22eb9fb7527f5876be8533851.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diza
185.161.248.90:4125
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Targets
-
-
Target
f26ecc3bfbfc14f505e8af1afd15c613767c25d22eb9fb7527f5876be8533851
-
Size
1.1MB
-
MD5
b12ed9aeb866600a4f487b83a19283a3
-
SHA1
bfbabac6ef252bb8acca1acb4259b1dff8cbbb50
-
SHA256
f26ecc3bfbfc14f505e8af1afd15c613767c25d22eb9fb7527f5876be8533851
-
SHA512
225228c6aa204d954c37c6f2fab1c26058d1cc74228dedf7bb1a934ed38004cfe31dc88c8054544ac0068571985c5015ab5bd77a163af460e88c4aa74c3edbf2
-
SSDEEP
24576:7ybayeLpXQL+JddGRPxjgWZzxPg9drZOoga4992bJkGyAuTK0H:ubaRLtQL+Jdo+W/PodrMoi9AJDqW0
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1