General
-
Target
2b33c343f047eed000e60fe371f743476cab6f11a2e08940d78c14e7d81c50e7N
-
Size
560KB
-
Sample
241109-xt8crazjev
-
MD5
2bc3a4e5378742893648f3e3a8c4f020
-
SHA1
248bfbb6d5261dd0e84a5bb8ef844fe12219c972
-
SHA256
2b33c343f047eed000e60fe371f743476cab6f11a2e08940d78c14e7d81c50e7
-
SHA512
cbeace33c551e1bcebf8b37cafaeeecacf8468740a57e22a9efcbeb19b2d37827ed50c2bece1238f88dc8dd322fb72f36766f6c9b4a9c24c13a73387656406d7
-
SSDEEP
12288:SMr8y908cIb2UVNHSjU0+s8xVK6wePnQr5KFtYk:+ysIb2INHSAps8x46wP5KFH
Static task
static1
Behavioral task
behavioral1
Sample
2b33c343f047eed000e60fe371f743476cab6f11a2e08940d78c14e7d81c50e7N.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
ronam
193.233.20.17:4139
-
auth_value
125421d19d14dd7fd211bc7f6d4aea6c
Targets
-
-
Target
2b33c343f047eed000e60fe371f743476cab6f11a2e08940d78c14e7d81c50e7N
-
Size
560KB
-
MD5
2bc3a4e5378742893648f3e3a8c4f020
-
SHA1
248bfbb6d5261dd0e84a5bb8ef844fe12219c972
-
SHA256
2b33c343f047eed000e60fe371f743476cab6f11a2e08940d78c14e7d81c50e7
-
SHA512
cbeace33c551e1bcebf8b37cafaeeecacf8468740a57e22a9efcbeb19b2d37827ed50c2bece1238f88dc8dd322fb72f36766f6c9b4a9c24c13a73387656406d7
-
SSDEEP
12288:SMr8y908cIb2UVNHSjU0+s8xVK6wePnQr5KFtYk:+ysIb2INHSAps8x46wP5KFH
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1