General
-
Target
ca128eb5983301b72298f82f1d5d0327dd540a28772b3344d891244c86b98abf
-
Size
480KB
-
Sample
241109-xl3gjazepe
-
MD5
c279ef7247683e1e7078e37757f98b2b
-
SHA1
095eba6fe5a256f8d227a25e18f3e78e49e778e1
-
SHA256
ca128eb5983301b72298f82f1d5d0327dd540a28772b3344d891244c86b98abf
-
SHA512
1feccdfd4557f56ffedf2b242011f13b63e27681df1d7ffbbb73439d6e3329aafcd442fa83dd604d07d304c336a940e298bd176e642807702ef2127baecbd2aa
-
SSDEEP
12288:LMr9y90RWFdUXvPomew3NKS/1oVbFW6z33FUiy6hRt8ktiGZPV:qyyWFGPfd/CE67VFV
Static task
static1
Behavioral task
behavioral1
Sample
ca128eb5983301b72298f82f1d5d0327dd540a28772b3344d891244c86b98abf.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
misfa
217.196.96.101:4132
-
auth_value
be2e6d9f1a5e54a81340947b20e561c1
Targets
-
-
Target
ca128eb5983301b72298f82f1d5d0327dd540a28772b3344d891244c86b98abf
-
Size
480KB
-
MD5
c279ef7247683e1e7078e37757f98b2b
-
SHA1
095eba6fe5a256f8d227a25e18f3e78e49e778e1
-
SHA256
ca128eb5983301b72298f82f1d5d0327dd540a28772b3344d891244c86b98abf
-
SHA512
1feccdfd4557f56ffedf2b242011f13b63e27681df1d7ffbbb73439d6e3329aafcd442fa83dd604d07d304c336a940e298bd176e642807702ef2127baecbd2aa
-
SSDEEP
12288:LMr9y90RWFdUXvPomew3NKS/1oVbFW6z33FUiy6hRt8ktiGZPV:qyyWFGPfd/CE67VFV
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1