General
-
Target
c57e5ca36e3302bcab0bf907a5716e4dac2e1f0573e7e23302d57f2ac0ea631b
-
Size
1.1MB
-
Sample
241109-ej8lnaxclr
-
MD5
4cc1f39895ae6f006d0d509d1028a8d2
-
SHA1
d6c658970ada62988dd637d0d80cfb7b78cad90b
-
SHA256
c57e5ca36e3302bcab0bf907a5716e4dac2e1f0573e7e23302d57f2ac0ea631b
-
SHA512
1a1f490b585a9ccc1294596bb951d74b970c071667698330bcfe96e97ce4c5ad264b63cc24b5a68f0523d2b5863bd3efa96ff146e0069cfe172a62fe56525c98
-
SSDEEP
24576:nyZhV7pDMVJoIsRqrz2e7u5k7lmXTi0rGcGKimC2/VnEtjR3yXNjpV:yZhVqVWIHv7uAlsi+Gjzm7/etVib
Static task
static1
Behavioral task
behavioral1
Sample
c57e5ca36e3302bcab0bf907a5716e4dac2e1f0573e7e23302d57f2ac0ea631b.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rumfa
193.233.20.24:4123
-
auth_value
749d02a6b4ef1fa2ad908e44ec2296dc
Targets
-
-
Target
c57e5ca36e3302bcab0bf907a5716e4dac2e1f0573e7e23302d57f2ac0ea631b
-
Size
1.1MB
-
MD5
4cc1f39895ae6f006d0d509d1028a8d2
-
SHA1
d6c658970ada62988dd637d0d80cfb7b78cad90b
-
SHA256
c57e5ca36e3302bcab0bf907a5716e4dac2e1f0573e7e23302d57f2ac0ea631b
-
SHA512
1a1f490b585a9ccc1294596bb951d74b970c071667698330bcfe96e97ce4c5ad264b63cc24b5a68f0523d2b5863bd3efa96ff146e0069cfe172a62fe56525c98
-
SSDEEP
24576:nyZhV7pDMVJoIsRqrz2e7u5k7lmXTi0rGcGKimC2/VnEtjR3yXNjpV:yZhVqVWIHv7uAlsi+Gjzm7/etVib
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1