General
-
Target
57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850
-
Size
657KB
-
Sample
241109-gzbmzazank
-
MD5
0ed9b4081c938784d0d47f5a05b2cb1d
-
SHA1
9bc8a9217b2054181a76c62131c462f9bde94c69
-
SHA256
57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850
-
SHA512
3356495c406f7f442bd1c0de248c6704791ad2ade1b11322891ecf5e6dedcc7fd0d8497f1f4240816dce670e17d6aaa0325a36dbdc6f820e69ebc4d3f05357a9
-
SSDEEP
12288:nMr8y90AkRJ0dxt+ZZ1N8aomr+0W9yx9OdAto8nEDG0JHxNcG2bB:3yLkRwxCNlqvUx8dA3EDbvN/c
Static task
static1
Behavioral task
behavioral1
Sample
57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Targets
-
-
Target
57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850
-
Size
657KB
-
MD5
0ed9b4081c938784d0d47f5a05b2cb1d
-
SHA1
9bc8a9217b2054181a76c62131c462f9bde94c69
-
SHA256
57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850
-
SHA512
3356495c406f7f442bd1c0de248c6704791ad2ade1b11322891ecf5e6dedcc7fd0d8497f1f4240816dce670e17d6aaa0325a36dbdc6f820e69ebc4d3f05357a9
-
SSDEEP
12288:nMr8y90AkRJ0dxt+ZZ1N8aomr+0W9yx9OdAto8nEDG0JHxNcG2bB:3yLkRwxCNlqvUx8dA3EDbvN/c
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1