General
-
Target
303e4764445e8d604b49296d4b92abe7d86f18688fb4d1bafdd0f7a1211dd0c2
-
Size
836KB
-
Sample
241109-xqk32ssqgk
-
MD5
52690da927ab4f5986cc49b4f3490fbf
-
SHA1
2f56c16f06f58977bbd42aae5b3952b723c440b5
-
SHA256
303e4764445e8d604b49296d4b92abe7d86f18688fb4d1bafdd0f7a1211dd0c2
-
SHA512
71cc1dc351774b96619c145901364739b0a9d286970057dde8b14ce4b0560ffe1cfefb81aacb6948d43e8a6fd319d6635e25de5a6942c09e3d6b0645279e4604
-
SSDEEP
12288:yMrry90a0KVKGI14l4dxLJDSGMWzBqWZOkDEtuJ7d7JT9qeUhH:ZyX5Alxx9TkkISd7lUfhH
Static task
static1
Behavioral task
behavioral1
Sample
303e4764445e8d604b49296d4b92abe7d86f18688fb4d1bafdd0f7a1211dd0c2.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Targets
-
-
Target
303e4764445e8d604b49296d4b92abe7d86f18688fb4d1bafdd0f7a1211dd0c2
-
Size
836KB
-
MD5
52690da927ab4f5986cc49b4f3490fbf
-
SHA1
2f56c16f06f58977bbd42aae5b3952b723c440b5
-
SHA256
303e4764445e8d604b49296d4b92abe7d86f18688fb4d1bafdd0f7a1211dd0c2
-
SHA512
71cc1dc351774b96619c145901364739b0a9d286970057dde8b14ce4b0560ffe1cfefb81aacb6948d43e8a6fd319d6635e25de5a6942c09e3d6b0645279e4604
-
SSDEEP
12288:yMrry90a0KVKGI14l4dxLJDSGMWzBqWZOkDEtuJ7d7JT9qeUhH:ZyX5Alxx9TkkISd7lUfhH
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1