General
-
Target
3251f5a261f2ce8b70a4503bea08358230266dfa2c8c2ee84ba3db3062ca7a8a
-
Size
532KB
-
Sample
241109-3nbdqavcpg
-
MD5
62df432bd3b351beae9aa84425bd5b9e
-
SHA1
36e723999fd74a9ca0fd32995f14d3f8afa3484d
-
SHA256
3251f5a261f2ce8b70a4503bea08358230266dfa2c8c2ee84ba3db3062ca7a8a
-
SHA512
0ad9aebe83f4a35a4b042cacaef0f2bf69b15557f9d4e84fff616aecb62d59cce094c2fe3904219e2cecfac59f792b0b25f75d537ad2c8ed51bf33f4bd510d92
-
SSDEEP
12288:9MrUy90SWx4RT3w7f9zax2mqL65/vVmJWY:lylqUwpax2mq+2wY
Static task
static1
Behavioral task
behavioral1
Sample
3251f5a261f2ce8b70a4503bea08358230266dfa2c8c2ee84ba3db3062ca7a8a.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
ruma
193.233.20.13:4136
-
auth_value
647d00dfaba082a4a30f383bca5d1a2a
Targets
-
-
Target
3251f5a261f2ce8b70a4503bea08358230266dfa2c8c2ee84ba3db3062ca7a8a
-
Size
532KB
-
MD5
62df432bd3b351beae9aa84425bd5b9e
-
SHA1
36e723999fd74a9ca0fd32995f14d3f8afa3484d
-
SHA256
3251f5a261f2ce8b70a4503bea08358230266dfa2c8c2ee84ba3db3062ca7a8a
-
SHA512
0ad9aebe83f4a35a4b042cacaef0f2bf69b15557f9d4e84fff616aecb62d59cce094c2fe3904219e2cecfac59f792b0b25f75d537ad2c8ed51bf33f4bd510d92
-
SSDEEP
12288:9MrUy90SWx4RT3w7f9zax2mqL65/vVmJWY:lylqUwpax2mq+2wY
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1