General
-
Target
47ae1c6254690c1e80b6b11806235c00865001d79781aa101740109681773f33
-
Size
538KB
-
Sample
241109-f286ksydkc
-
MD5
f7194dfecd27983d6ceb041ab5f0e960
-
SHA1
4e2027c661ac6007f99ca729c0ef9fb0bbfa7217
-
SHA256
47ae1c6254690c1e80b6b11806235c00865001d79781aa101740109681773f33
-
SHA512
7e9b71cfb874906f23aa17bc6687480618c39215d4725011314036f3b7184ac1ceeae8cdf4b2b4f439b7caa841d410575f8d19554b208bff0965d2cdf28eb617
-
SSDEEP
12288:kMr0y90bdpjDKpwomdKA6KbqStH/3CjTcFduHf:oyqjetCMKOW/3Ocbi
Static task
static1
Behavioral task
behavioral1
Sample
47ae1c6254690c1e80b6b11806235c00865001d79781aa101740109681773f33.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
ruzhpe
pepunn.com:4162
-
auth_value
f735ced96ae8d01d0bd1d514240e54e0
Targets
-
-
Target
47ae1c6254690c1e80b6b11806235c00865001d79781aa101740109681773f33
-
Size
538KB
-
MD5
f7194dfecd27983d6ceb041ab5f0e960
-
SHA1
4e2027c661ac6007f99ca729c0ef9fb0bbfa7217
-
SHA256
47ae1c6254690c1e80b6b11806235c00865001d79781aa101740109681773f33
-
SHA512
7e9b71cfb874906f23aa17bc6687480618c39215d4725011314036f3b7184ac1ceeae8cdf4b2b4f439b7caa841d410575f8d19554b208bff0965d2cdf28eb617
-
SSDEEP
12288:kMr0y90bdpjDKpwomdKA6KbqStH/3CjTcFduHf:oyqjetCMKOW/3Ocbi
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1