General
-
Target
6074a4d025c8ceb1d64dbceec365ad4461a666384eae888794cb5bc4a23b7909
-
Size
550KB
-
Sample
241109-ebbxqaxalh
-
MD5
99adba78ec995eddcec1e4665b9e56e0
-
SHA1
7559155264dd8713d63a49af61cb2cb5cdca8a7f
-
SHA256
6074a4d025c8ceb1d64dbceec365ad4461a666384eae888794cb5bc4a23b7909
-
SHA512
c69dc3a1097fe4a6de899be77e744d6ca14afe95cf19a0e059195c0887f3e0dd4e619c47da79432047cde206825a7102d2266514ca14a79cd9d7e09779c60c72
-
SSDEEP
12288:jMrCy90UI8xG0OrWMGBYdviqbk0ksPSjFnsUvYLK:hylI9+dNfWiY+
Static task
static1
Behavioral task
behavioral1
Sample
6074a4d025c8ceb1d64dbceec365ad4461a666384eae888794cb5bc4a23b7909.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Targets
-
-
Target
6074a4d025c8ceb1d64dbceec365ad4461a666384eae888794cb5bc4a23b7909
-
Size
550KB
-
MD5
99adba78ec995eddcec1e4665b9e56e0
-
SHA1
7559155264dd8713d63a49af61cb2cb5cdca8a7f
-
SHA256
6074a4d025c8ceb1d64dbceec365ad4461a666384eae888794cb5bc4a23b7909
-
SHA512
c69dc3a1097fe4a6de899be77e744d6ca14afe95cf19a0e059195c0887f3e0dd4e619c47da79432047cde206825a7102d2266514ca14a79cd9d7e09779c60c72
-
SSDEEP
12288:jMrCy90UI8xG0OrWMGBYdviqbk0ksPSjFnsUvYLK:hylI9+dNfWiY+
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1