General
-
Target
3bfe4f2096a3f315f72c39ff4876b03c5a5bd92fe0c9299184a5971d9dcb10a2
-
Size
547KB
-
Sample
241109-xnmtvssqcp
-
MD5
e9534fea48ce90edc1960f85820e8b8f
-
SHA1
8048874098d558588d6228ff06402bab8058b296
-
SHA256
3bfe4f2096a3f315f72c39ff4876b03c5a5bd92fe0c9299184a5971d9dcb10a2
-
SHA512
6cb96e4250bc55426b6ff85a76f962087c9ba9e78e0fa3a768fcdddb7254b532c6a78db4054a7ef260faac9a77f22de627e1d37f76da2531ab30e7eb6915c8fc
-
SSDEEP
12288:IMr+y900sEM0fT68kwlTyVkCDcC4hOKa5+:Gy0EZfR5RyVkCDf4hOl+
Static task
static1
Behavioral task
behavioral1
Sample
3bfe4f2096a3f315f72c39ff4876b03c5a5bd92fe0c9299184a5971d9dcb10a2.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rumfa
193.233.20.24:4123
-
auth_value
749d02a6b4ef1fa2ad908e44ec2296dc
Targets
-
-
Target
3bfe4f2096a3f315f72c39ff4876b03c5a5bd92fe0c9299184a5971d9dcb10a2
-
Size
547KB
-
MD5
e9534fea48ce90edc1960f85820e8b8f
-
SHA1
8048874098d558588d6228ff06402bab8058b296
-
SHA256
3bfe4f2096a3f315f72c39ff4876b03c5a5bd92fe0c9299184a5971d9dcb10a2
-
SHA512
6cb96e4250bc55426b6ff85a76f962087c9ba9e78e0fa3a768fcdddb7254b532c6a78db4054a7ef260faac9a77f22de627e1d37f76da2531ab30e7eb6915c8fc
-
SSDEEP
12288:IMr+y900sEM0fT68kwlTyVkCDcC4hOKa5+:Gy0EZfR5RyVkCDf4hOl+
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1