General
-
Target
6c311ee8d9090705e269d671db66cacccd41cc0c5bf2331b5774f210ce59f931
-
Size
1000KB
-
Sample
241109-xttvcszgjf
-
MD5
994fcc05197111cc1d065135b940bdd3
-
SHA1
959f9a1085948ecb758c635dee6a4610438ea06d
-
SHA256
6c311ee8d9090705e269d671db66cacccd41cc0c5bf2331b5774f210ce59f931
-
SHA512
8f8194b3b2fd1731ce23e0d3d68e5c303451ff16fb7c8368e72e9eb943c0700903e0150e84461b7570dfe631fe226cd4913fb77e28e45f4ca0fb92638f2f8d1a
-
SSDEEP
24576:6y31BAXIik6BNeIcvAVkmRBcTEotSmuEjag:BFBAXIivBNeIcvKkz39N
Static task
static1
Behavioral task
behavioral1
Sample
6c311ee8d9090705e269d671db66cacccd41cc0c5bf2331b5774f210ce59f931.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Targets
-
-
Target
6c311ee8d9090705e269d671db66cacccd41cc0c5bf2331b5774f210ce59f931
-
Size
1000KB
-
MD5
994fcc05197111cc1d065135b940bdd3
-
SHA1
959f9a1085948ecb758c635dee6a4610438ea06d
-
SHA256
6c311ee8d9090705e269d671db66cacccd41cc0c5bf2331b5774f210ce59f931
-
SHA512
8f8194b3b2fd1731ce23e0d3d68e5c303451ff16fb7c8368e72e9eb943c0700903e0150e84461b7570dfe631fe226cd4913fb77e28e45f4ca0fb92638f2f8d1a
-
SSDEEP
24576:6y31BAXIik6BNeIcvAVkmRBcTEotSmuEjag:BFBAXIivBNeIcvKkz39N
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1