General
-
Target
f490ca1031d944979ac496eff22eae8cf329a5da283d9c26e29f8cbadd3fe644
-
Size
680KB
-
Sample
241109-fvq2es1mcp
-
MD5
731ab81a342a95eabcc43f3f18338952
-
SHA1
d493ece03e5da89474f9e496e07190ab27aade54
-
SHA256
f490ca1031d944979ac496eff22eae8cf329a5da283d9c26e29f8cbadd3fe644
-
SHA512
addeea859b3caa365bd2f65fdd97286d202434299390d65ac204f8d05cc09d87d9e945602d4ec5a678a346ae8a98d3ad262128c2f8c1a2ddf63bb01bf9901386
-
SSDEEP
12288:uX7oJKZmgqrU61SF/LArdDoJPHtR53SuyNTOrCpJeyZX0hcIQv:aIKZvQFUFs5o9Hn53SusJVX8Qv
Static task
static1
Behavioral task
behavioral1
Sample
f490ca1031d944979ac496eff22eae8cf329a5da283d9c26e29f8cbadd3fe644.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f490ca1031d944979ac496eff22eae8cf329a5da283d9c26e29f8cbadd3fe644.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Targets
-
-
Target
f490ca1031d944979ac496eff22eae8cf329a5da283d9c26e29f8cbadd3fe644
-
Size
680KB
-
MD5
731ab81a342a95eabcc43f3f18338952
-
SHA1
d493ece03e5da89474f9e496e07190ab27aade54
-
SHA256
f490ca1031d944979ac496eff22eae8cf329a5da283d9c26e29f8cbadd3fe644
-
SHA512
addeea859b3caa365bd2f65fdd97286d202434299390d65ac204f8d05cc09d87d9e945602d4ec5a678a346ae8a98d3ad262128c2f8c1a2ddf63bb01bf9901386
-
SSDEEP
12288:uX7oJKZmgqrU61SF/LArdDoJPHtR53SuyNTOrCpJeyZX0hcIQv:aIKZvQFUFs5o9Hn53SusJVX8Qv
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1