General
-
Target
fd9837ba64fab2e853ac6878ebcf33d426665915a0ad551ca01053cb3a50cf3f
-
Size
538KB
-
Sample
241109-d67gfawlbz
-
MD5
be82f3d626943e6df30f36f203bbf855
-
SHA1
76256c3503140374b6e9b26541f9380b31e7262b
-
SHA256
fd9837ba64fab2e853ac6878ebcf33d426665915a0ad551ca01053cb3a50cf3f
-
SHA512
164c9073c411cb3e030227c15b8a35a1c1571e5cd0ac152eba69da7e4c731795724d57512418e034a0f850abf9196d0d814df48834515bd3c58be780ac8db0f6
-
SSDEEP
12288:MMrKy90YcNq3/vaPkf9FaQeEaSHjPNHfRdEpiD85HxrJIg:mykT29PeEaSDPN/RGpJH1p
Static task
static1
Behavioral task
behavioral1
Sample
fd9837ba64fab2e853ac6878ebcf33d426665915a0ad551ca01053cb3a50cf3f.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rosto
hueref.eu:4162
-
auth_value
07d81eba8cad42bbd0ae60042d48eac6
Targets
-
-
Target
fd9837ba64fab2e853ac6878ebcf33d426665915a0ad551ca01053cb3a50cf3f
-
Size
538KB
-
MD5
be82f3d626943e6df30f36f203bbf855
-
SHA1
76256c3503140374b6e9b26541f9380b31e7262b
-
SHA256
fd9837ba64fab2e853ac6878ebcf33d426665915a0ad551ca01053cb3a50cf3f
-
SHA512
164c9073c411cb3e030227c15b8a35a1c1571e5cd0ac152eba69da7e4c731795724d57512418e034a0f850abf9196d0d814df48834515bd3c58be780ac8db0f6
-
SSDEEP
12288:MMrKy90YcNq3/vaPkf9FaQeEaSHjPNHfRdEpiD85HxrJIg:mykT29PeEaSDPN/RGpJH1p
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1