General
-
Target
21f457c5e1500e5dd8b750a8e6dd1426bd8a81c66efc85126f3d8fbf6a151e93N.exe
-
Size
468KB
-
Sample
241110-16splswkhs
-
MD5
d46866358c2f21ecd6696516aa0007d6
-
SHA1
878c5f0d4e8a77693ff905fc05bf63a9aacf2303
-
SHA256
98976b44ca88d8a3b7bbc984f24441e2589c07a673c0d13b999690047328831d
-
SHA512
1a75b27ba7c9aa5a48ceefb9a1400c321a0e336bc9054f801ef2c376513d3a733543214cfd9241889ec102fddd40665a44692d355e9d5b9b069824ad44a4d780
-
SSDEEP
12288:py90F/j+rUKX8WJzt//HQBrfzWOOWE/Fz4Sj:pyuyZt//w9fzROTdJj
Static task
static1
Behavioral task
behavioral1
Sample
21f457c5e1500e5dd8b750a8e6dd1426bd8a81c66efc85126f3d8fbf6a151e93N.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
21f457c5e1500e5dd8b750a8e6dd1426bd8a81c66efc85126f3d8fbf6a151e93N.exe
-
Size
468KB
-
MD5
d46866358c2f21ecd6696516aa0007d6
-
SHA1
878c5f0d4e8a77693ff905fc05bf63a9aacf2303
-
SHA256
98976b44ca88d8a3b7bbc984f24441e2589c07a673c0d13b999690047328831d
-
SHA512
1a75b27ba7c9aa5a48ceefb9a1400c321a0e336bc9054f801ef2c376513d3a733543214cfd9241889ec102fddd40665a44692d355e9d5b9b069824ad44a4d780
-
SSDEEP
12288:py90F/j+rUKX8WJzt//HQBrfzWOOWE/Fz4Sj:pyuyZt//w9fzROTdJj
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1