General
-
Target
2399fb86d805d5b088fc2b2b764014146289d5761f3fc289e1b2af7d7b37251a
-
Size
850KB
-
Sample
241108-ayz6ls1fle
-
MD5
f2e13219ec940c5f5c93a7ed8d7dbbcf
-
SHA1
81337dcd9e9ee14de73b8db85e3264ed519b5fff
-
SHA256
2399fb86d805d5b088fc2b2b764014146289d5761f3fc289e1b2af7d7b37251a
-
SHA512
a19d4bd53895df5df95abdeacca78bdbd1496bfa28b3f552cbd85c29d433c00f39b1a0a0455a6012562d7fbaf6713bee4d619b51fcdeac98f9a7505e2ad1eb6a
-
SSDEEP
24576:0yYExKnMYo6ytwEimrjzK+n1Ke64Vxf/gAYl:D1KnMYt4rHJn364VdgT
Static task
static1
Behavioral task
behavioral1
Sample
2399fb86d805d5b088fc2b2b764014146289d5761f3fc289e1b2af7d7b37251a.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diza
185.161.248.90:4125
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Targets
-
-
Target
2399fb86d805d5b088fc2b2b764014146289d5761f3fc289e1b2af7d7b37251a
-
Size
850KB
-
MD5
f2e13219ec940c5f5c93a7ed8d7dbbcf
-
SHA1
81337dcd9e9ee14de73b8db85e3264ed519b5fff
-
SHA256
2399fb86d805d5b088fc2b2b764014146289d5761f3fc289e1b2af7d7b37251a
-
SHA512
a19d4bd53895df5df95abdeacca78bdbd1496bfa28b3f552cbd85c29d433c00f39b1a0a0455a6012562d7fbaf6713bee4d619b51fcdeac98f9a7505e2ad1eb6a
-
SSDEEP
24576:0yYExKnMYo6ytwEimrjzK+n1Ke64Vxf/gAYl:D1KnMYt4rHJn364VdgT
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1