General
-
Target
961e6244e9559d09b07578e06de604804c7f121e74774b0df4b4da1a6fa51b24
-
Size
544KB
-
Sample
241109-x5bg6atkcq
-
MD5
fde51c34352fae49f327e934b43682a1
-
SHA1
9d7f2c1f41dc49095d9c1c17e8e757f7bbedcc49
-
SHA256
961e6244e9559d09b07578e06de604804c7f121e74774b0df4b4da1a6fa51b24
-
SHA512
ecb02b4b7d8335e9f91a30ce82be594103afe2141f2e7dc8158e8aeb0ded557b918f95610da29537635dc7cea062dca7d4ea69aac5ca1dbb93145a16a938441e
-
SSDEEP
12288:zMruy90hAb+PBulNDof0AqgUrMLPwyOWMCoWGciz7s:ByglJuDMqMbAeGc87s
Static task
static1
Behavioral task
behavioral1
Sample
961e6244e9559d09b07578e06de604804c7f121e74774b0df4b4da1a6fa51b24.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Targets
-
-
Target
961e6244e9559d09b07578e06de604804c7f121e74774b0df4b4da1a6fa51b24
-
Size
544KB
-
MD5
fde51c34352fae49f327e934b43682a1
-
SHA1
9d7f2c1f41dc49095d9c1c17e8e757f7bbedcc49
-
SHA256
961e6244e9559d09b07578e06de604804c7f121e74774b0df4b4da1a6fa51b24
-
SHA512
ecb02b4b7d8335e9f91a30ce82be594103afe2141f2e7dc8158e8aeb0ded557b918f95610da29537635dc7cea062dca7d4ea69aac5ca1dbb93145a16a938441e
-
SSDEEP
12288:zMruy90hAb+PBulNDof0AqgUrMLPwyOWMCoWGciz7s:ByglJuDMqMbAeGc87s
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1