General
-
Target
4cef13a26f1030d0a375accecebc4b227c53e1514eb8fd8202c16e2da5e3a176
-
Size
836KB
-
Sample
241109-x2n9vazkf1
-
MD5
23597aa922739a03ee1c71276ff3380f
-
SHA1
6e3a11b81e53dd14d891f91aea523aa476f4cba6
-
SHA256
4cef13a26f1030d0a375accecebc4b227c53e1514eb8fd8202c16e2da5e3a176
-
SHA512
0e17b82d8dd8943d3e8bee45f8e79883e5fce22730b1f566261c0d82f19cea5f6de167f7b74862158ecc473b26e8848f3fee55fb20fbab75219a5128c9418005
-
SSDEEP
12288:dMrzy90WLgykYqsbUTWyT7IyaAOQ5bPyq91gNYm2cRwah2DlESPYF9ok1O:6ylg1cbUXT7l5jf02Uwah2D+S69okM
Static task
static1
Behavioral task
behavioral1
Sample
4cef13a26f1030d0a375accecebc4b227c53e1514eb8fd8202c16e2da5e3a176.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Targets
-
-
Target
4cef13a26f1030d0a375accecebc4b227c53e1514eb8fd8202c16e2da5e3a176
-
Size
836KB
-
MD5
23597aa922739a03ee1c71276ff3380f
-
SHA1
6e3a11b81e53dd14d891f91aea523aa476f4cba6
-
SHA256
4cef13a26f1030d0a375accecebc4b227c53e1514eb8fd8202c16e2da5e3a176
-
SHA512
0e17b82d8dd8943d3e8bee45f8e79883e5fce22730b1f566261c0d82f19cea5f6de167f7b74862158ecc473b26e8848f3fee55fb20fbab75219a5128c9418005
-
SSDEEP
12288:dMrzy90WLgykYqsbUTWyT7IyaAOQ5bPyq91gNYm2cRwah2DlESPYF9ok1O:6ylg1cbUXT7l5jf02Uwah2D+S69okM
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1