General
-
Target
861c263188850aaf304a7294b39c5dd079f5e1e1439b8db847b32a277dfa8702
-
Size
409KB
-
Sample
241109-eekc9sxbjg
-
MD5
e184206feccce6588e4a42b6ef634cb4
-
SHA1
2e0a11208e93ab48931d19f14663c45fa460c282
-
SHA256
861c263188850aaf304a7294b39c5dd079f5e1e1439b8db847b32a277dfa8702
-
SHA512
faf1a5e20b1383a866b8c15dce04df33c02a1bfa17a4cf4f7968277da249b66efd82899c505fe5db01df6ca8be69785d22c70d88675dc374d4ad55327b813cdf
-
SSDEEP
12288:sMrPy904rqT3SQsdygA3EgV9N0UGNag2ukGS:7yJCsdmPV9N0UGNackGS
Static task
static1
Behavioral task
behavioral1
Sample
861c263188850aaf304a7294b39c5dd079f5e1e1439b8db847b32a277dfa8702.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Targets
-
-
Target
861c263188850aaf304a7294b39c5dd079f5e1e1439b8db847b32a277dfa8702
-
Size
409KB
-
MD5
e184206feccce6588e4a42b6ef634cb4
-
SHA1
2e0a11208e93ab48931d19f14663c45fa460c282
-
SHA256
861c263188850aaf304a7294b39c5dd079f5e1e1439b8db847b32a277dfa8702
-
SHA512
faf1a5e20b1383a866b8c15dce04df33c02a1bfa17a4cf4f7968277da249b66efd82899c505fe5db01df6ca8be69785d22c70d88675dc374d4ad55327b813cdf
-
SSDEEP
12288:sMrPy904rqT3SQsdygA3EgV9N0UGNag2ukGS:7yJCsdmPV9N0UGNackGS
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1