General
-
Target
9efa17c24797b40d743e981010be83f33da13707fb02888a688bb22e0ef53b9f
-
Size
1.1MB
-
Sample
241109-epj59azmhn
-
MD5
0228eb5d18527f2a54aa8fbe7c70dd73
-
SHA1
09e47856ef8d11a9007f2dc48422f8aad3b0dbc7
-
SHA256
9efa17c24797b40d743e981010be83f33da13707fb02888a688bb22e0ef53b9f
-
SHA512
d6be8c9b7d8d5b2d9c5138f7960a97476fb63321eeb129b5f2e586025ccd8c64635e45a2f2afcf0ce1f3f2b2463e82de9c3536146c73b1590347e323569b50ad
-
SSDEEP
24576:dybMoO1tN8iMvJeLCR5OVoChifmJu0i48HGnsoHK7uSN:4HO9MvJTpfqx5kGnsmAu
Static task
static1
Behavioral task
behavioral1
Sample
9efa17c24797b40d743e981010be83f33da13707fb02888a688bb22e0ef53b9f.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rumfa
193.233.20.24:4123
-
auth_value
749d02a6b4ef1fa2ad908e44ec2296dc
Targets
-
-
Target
9efa17c24797b40d743e981010be83f33da13707fb02888a688bb22e0ef53b9f
-
Size
1.1MB
-
MD5
0228eb5d18527f2a54aa8fbe7c70dd73
-
SHA1
09e47856ef8d11a9007f2dc48422f8aad3b0dbc7
-
SHA256
9efa17c24797b40d743e981010be83f33da13707fb02888a688bb22e0ef53b9f
-
SHA512
d6be8c9b7d8d5b2d9c5138f7960a97476fb63321eeb129b5f2e586025ccd8c64635e45a2f2afcf0ce1f3f2b2463e82de9c3536146c73b1590347e323569b50ad
-
SSDEEP
24576:dybMoO1tN8iMvJeLCR5OVoChifmJu0i48HGnsoHK7uSN:4HO9MvJTpfqx5kGnsmAu
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1