General
-
Target
0918bf535bde77cdf7c409c12fbd6e542c2078173ee4233bf655d34fcb917eac
-
Size
672KB
-
Sample
241109-d8yx3swhra
-
MD5
68ed83ac8172ff52c1401262bb11a14b
-
SHA1
87bfeccb388dfb0c0ab2af712d5a45359ffaaf5d
-
SHA256
0918bf535bde77cdf7c409c12fbd6e542c2078173ee4233bf655d34fcb917eac
-
SHA512
61d97877691bcc62c2fdc89ef9f04a2475b6db7c12280073daa7540941bbfc8e787edf9909d677de9d058bb62b0a67058bf2c365fa47eb6849b056c4937d54c2
-
SSDEEP
12288:rMrHy90sUtPwomPLFkYwtqBDiFMeBCP76BpJ1gI7jYom/p+YUBfhpMg3pmMjsy:kyowLFkBtwQMrTGpJ1gYYo5FTFAMjn
Static task
static1
Behavioral task
behavioral1
Sample
0918bf535bde77cdf7c409c12fbd6e542c2078173ee4233bf655d34fcb917eac.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Targets
-
-
Target
0918bf535bde77cdf7c409c12fbd6e542c2078173ee4233bf655d34fcb917eac
-
Size
672KB
-
MD5
68ed83ac8172ff52c1401262bb11a14b
-
SHA1
87bfeccb388dfb0c0ab2af712d5a45359ffaaf5d
-
SHA256
0918bf535bde77cdf7c409c12fbd6e542c2078173ee4233bf655d34fcb917eac
-
SHA512
61d97877691bcc62c2fdc89ef9f04a2475b6db7c12280073daa7540941bbfc8e787edf9909d677de9d058bb62b0a67058bf2c365fa47eb6849b056c4937d54c2
-
SSDEEP
12288:rMrHy90sUtPwomPLFkYwtqBDiFMeBCP76BpJ1gI7jYom/p+YUBfhpMg3pmMjsy:kyowLFkBtwQMrTGpJ1gYYo5FTFAMjn
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1