General
-
Target
eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c
-
Size
934KB
-
Sample
241109-fyf1maycmf
-
MD5
1e1b2decc3b0f8255253d45ffc188d59
-
SHA1
c3b0ab84ecc0fedeb2069e7c1bc92695a3ff03fb
-
SHA256
eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c
-
SHA512
b8246d2e587efde482eeb5c51f2b04878e9e151766192b15216d8eb13144e9855a82398fd7ead99647e3d10cda1bd4aa511dd8a29627dc6bfa96ef792cbc6e97
-
SSDEEP
24576:mynfubRt8a3yVdcri2PCAZfQlsK7It42Qwy:1niRt8vJgwFIy3w
Static task
static1
Behavioral task
behavioral1
Sample
eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
dark
185.161.248.73:4164
-
auth_value
ae85b01f66afe8770afeed560513fc2d
Targets
-
-
Target
eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c
-
Size
934KB
-
MD5
1e1b2decc3b0f8255253d45ffc188d59
-
SHA1
c3b0ab84ecc0fedeb2069e7c1bc92695a3ff03fb
-
SHA256
eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c
-
SHA512
b8246d2e587efde482eeb5c51f2b04878e9e151766192b15216d8eb13144e9855a82398fd7ead99647e3d10cda1bd4aa511dd8a29627dc6bfa96ef792cbc6e97
-
SSDEEP
24576:mynfubRt8a3yVdcri2PCAZfQlsK7It42Qwy:1niRt8vJgwFIy3w
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1