General
-
Target
4675882d585ca5395a61abfe7065621736538a75941c6cd778df2c8b58a34ab1
-
Size
836KB
-
Sample
241109-d8js6axakj
-
MD5
88467adcd557dd3731232f6dbee59752
-
SHA1
21ed82e98c264ad414beddd151da406ac42a2d04
-
SHA256
4675882d585ca5395a61abfe7065621736538a75941c6cd778df2c8b58a34ab1
-
SHA512
2b0c6735adb3104bb7736ec48b1212b1dde3772720fe49f1faf11b7de6271ea206846cbbea8162346bfd17b7e823bdffa1406aefdab7609dcc8b0ba47bcdd512
-
SSDEEP
12288:bMr9y90AEszqje+iWu0+wsXomr/EZsXe1M4VmplQ5RmiMBtjgxHZ6gFPR136w+z:SyFE/c22O1M4VcQnmiMDjgx564P3uz
Static task
static1
Behavioral task
behavioral1
Sample
4675882d585ca5395a61abfe7065621736538a75941c6cd778df2c8b58a34ab1.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Targets
-
-
Target
4675882d585ca5395a61abfe7065621736538a75941c6cd778df2c8b58a34ab1
-
Size
836KB
-
MD5
88467adcd557dd3731232f6dbee59752
-
SHA1
21ed82e98c264ad414beddd151da406ac42a2d04
-
SHA256
4675882d585ca5395a61abfe7065621736538a75941c6cd778df2c8b58a34ab1
-
SHA512
2b0c6735adb3104bb7736ec48b1212b1dde3772720fe49f1faf11b7de6271ea206846cbbea8162346bfd17b7e823bdffa1406aefdab7609dcc8b0ba47bcdd512
-
SSDEEP
12288:bMr9y90AEszqje+iWu0+wsXomr/EZsXe1M4VmplQ5RmiMBtjgxHZ6gFPR136w+z:SyFE/c22O1M4VcQnmiMDjgx564P3uz
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1