General
-
Target
53e2825ce3a307753508dd39fafba52b1fd03ec36f4790fb005e52b5ffbfc4f5
-
Size
1.4MB
-
Sample
241109-x43j9azlbs
-
MD5
32b535c9509a82fa0a413280d9f1c7ad
-
SHA1
cd2efd3ab56b5425e9eec838e06ebd0afb9266e7
-
SHA256
53e2825ce3a307753508dd39fafba52b1fd03ec36f4790fb005e52b5ffbfc4f5
-
SHA512
189336a9aa600a68de297074274aa401f56617c3582ab78b131659790757f51de293aae64786fe6d50dc73da5b34f462ad7cf04a89859ca4c6a32c6660b2b55e
-
SSDEEP
24576:Uy0opVWrxoc+2FeWPDN3lJLmETYdr4CRlvkVdTComZoi/1pF7zuQ:j92Vx+2MKDBLmfdr46vknnmZxf
Static task
static1
Behavioral task
behavioral1
Sample
53e2825ce3a307753508dd39fafba52b1fd03ec36f4790fb005e52b5ffbfc4f5.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
mask
217.196.96.56:4138
-
auth_value
31aef25be0febb8e491794ef7f502c50
Targets
-
-
Target
53e2825ce3a307753508dd39fafba52b1fd03ec36f4790fb005e52b5ffbfc4f5
-
Size
1.4MB
-
MD5
32b535c9509a82fa0a413280d9f1c7ad
-
SHA1
cd2efd3ab56b5425e9eec838e06ebd0afb9266e7
-
SHA256
53e2825ce3a307753508dd39fafba52b1fd03ec36f4790fb005e52b5ffbfc4f5
-
SHA512
189336a9aa600a68de297074274aa401f56617c3582ab78b131659790757f51de293aae64786fe6d50dc73da5b34f462ad7cf04a89859ca4c6a32c6660b2b55e
-
SSDEEP
24576:Uy0opVWrxoc+2FeWPDN3lJLmETYdr4CRlvkVdTComZoi/1pF7zuQ:j92Vx+2MKDBLmfdr46vknnmZxf
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1