General
-
Target
68d6e09074432c636b1b232a461bfa46cd9517c27730339d4ed26db71e61aa40
-
Size
480KB
-
Sample
241109-edxxzawmez
-
MD5
3dbe7b5671fe69b282ef9d9cce5eef68
-
SHA1
f0bf24e38c15245b1f544bfce667da751bbd7f40
-
SHA256
68d6e09074432c636b1b232a461bfa46cd9517c27730339d4ed26db71e61aa40
-
SHA512
792cb2193d646834135af5244119e6c707ce366f2f9a1184903cb608803c164895398b0d264872c1e22e5f31b05dfa70de20e1147e9714cc3216099211381241
-
SSDEEP
12288:CMrXy9020GY5KCvgGU+FzgMh13yGmB3Xrr1zA:dyFYc0tU2H5upr2
Static task
static1
Behavioral task
behavioral1
Sample
68d6e09074432c636b1b232a461bfa46cd9517c27730339d4ed26db71e61aa40.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
mihan
217.196.96.101:4132
-
auth_value
9a6a8fdae02ed7caa0a49a6ddc6d4520
Targets
-
-
Target
68d6e09074432c636b1b232a461bfa46cd9517c27730339d4ed26db71e61aa40
-
Size
480KB
-
MD5
3dbe7b5671fe69b282ef9d9cce5eef68
-
SHA1
f0bf24e38c15245b1f544bfce667da751bbd7f40
-
SHA256
68d6e09074432c636b1b232a461bfa46cd9517c27730339d4ed26db71e61aa40
-
SHA512
792cb2193d646834135af5244119e6c707ce366f2f9a1184903cb608803c164895398b0d264872c1e22e5f31b05dfa70de20e1147e9714cc3216099211381241
-
SSDEEP
12288:CMrXy9020GY5KCvgGU+FzgMh13yGmB3Xrr1zA:dyFYc0tU2H5upr2
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1