General
-
Target
2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed
-
Size
707KB
-
Sample
241109-ecsa4axape
-
MD5
357080a4e729d9e86102759a046157f3
-
SHA1
fe89e9729ae10a27dfe3845fb405e13059f49f8a
-
SHA256
2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed
-
SHA512
726cdd826bc09cb09042abc2f0732d1ca8bf640f134f2c1e5078ba8b1133f5ef2766b00d296e091bcf8e3b7b13a18d599ef11ca94ac032e936512c90b2cd9f07
-
SSDEEP
12288:Yy90T1atUdA10oGbbkYRlFIDOjxDcQi93uumzDJSsdn7Um+EduASlVvGh1EK:Yyea2o+IUAyJcQjlp7m0GlVvM1EK
Static task
static1
Behavioral task
behavioral1
Sample
2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed
-
Size
707KB
-
MD5
357080a4e729d9e86102759a046157f3
-
SHA1
fe89e9729ae10a27dfe3845fb405e13059f49f8a
-
SHA256
2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed
-
SHA512
726cdd826bc09cb09042abc2f0732d1ca8bf640f134f2c1e5078ba8b1133f5ef2766b00d296e091bcf8e3b7b13a18d599ef11ca94ac032e936512c90b2cd9f07
-
SSDEEP
12288:Yy90T1atUdA10oGbbkYRlFIDOjxDcQi93uumzDJSsdn7Um+EduASlVvGh1EK:Yyea2o+IUAyJcQjlp7m0GlVvM1EK
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1