General
-
Target
f1b35a805ca57290655c7db8112f5ab9388eef8d2e7cfe8d4b9a5c6d411f63cc
-
Size
695KB
-
Sample
241109-eeattswmfv
-
MD5
8980a9db3873b3dc19cb280771636d2c
-
SHA1
fe12c476cbac5048ee14d95fbbde435aa5cca59a
-
SHA256
f1b35a805ca57290655c7db8112f5ab9388eef8d2e7cfe8d4b9a5c6d411f63cc
-
SHA512
7c040129a03f22c0eff9b05aeab9368fa98c7fa6e11385cdb3d2a5ad64a678790c102faa7f78ef4d64ace54f5387659c799b164feae02d31af01a38b79ebb48a
-
SSDEEP
12288:ny90+3BuJmBGuO/sz/+tZ9COJq9Imxr8ZXLWT6rD18bAKdA+u3TCk:ny/uJRqz/+tXCVb6m6rD18bAuCCk
Static task
static1
Behavioral task
behavioral1
Sample
f1b35a805ca57290655c7db8112f5ab9388eef8d2e7cfe8d4b9a5c6d411f63cc.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
f1b35a805ca57290655c7db8112f5ab9388eef8d2e7cfe8d4b9a5c6d411f63cc
-
Size
695KB
-
MD5
8980a9db3873b3dc19cb280771636d2c
-
SHA1
fe12c476cbac5048ee14d95fbbde435aa5cca59a
-
SHA256
f1b35a805ca57290655c7db8112f5ab9388eef8d2e7cfe8d4b9a5c6d411f63cc
-
SHA512
7c040129a03f22c0eff9b05aeab9368fa98c7fa6e11385cdb3d2a5ad64a678790c102faa7f78ef4d64ace54f5387659c799b164feae02d31af01a38b79ebb48a
-
SSDEEP
12288:ny90+3BuJmBGuO/sz/+tZ9COJq9Imxr8ZXLWT6rD18bAKdA+u3TCk:ny/uJRqz/+tXCVb6m6rD18bAuCCk
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1