General
-
Target
84fdfde0af8e431ec192d975e95c933e8d8dbc55c8a70c66c7d1e44aaa900630
-
Size
1.1MB
-
Sample
241110-a459tavnbt
-
MD5
7f2477ab81f10e6920b4c44220ddb91e
-
SHA1
37f060bf4105dd9dc0615a21440a5ffe673966d7
-
SHA256
84fdfde0af8e431ec192d975e95c933e8d8dbc55c8a70c66c7d1e44aaa900630
-
SHA512
d15aa3d6c35ace6c3b022e649d4dec667e00570fca2312bbfb7be55d75fce887cad7e9f73193b5c4a9102766c3af3aab7e1594b2d70993724612f080e0a0fba8
-
SSDEEP
24576:DyofxB/rPoDZxGAOKi+Y/E4TZN1/u4Kg:Wy//8D2wP
Static task
static1
Behavioral task
behavioral1
Sample
84fdfde0af8e431ec192d975e95c933e8d8dbc55c8a70c66c7d1e44aaa900630.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rumfa
193.233.20.24:4123
-
auth_value
749d02a6b4ef1fa2ad908e44ec2296dc
Targets
-
-
Target
84fdfde0af8e431ec192d975e95c933e8d8dbc55c8a70c66c7d1e44aaa900630
-
Size
1.1MB
-
MD5
7f2477ab81f10e6920b4c44220ddb91e
-
SHA1
37f060bf4105dd9dc0615a21440a5ffe673966d7
-
SHA256
84fdfde0af8e431ec192d975e95c933e8d8dbc55c8a70c66c7d1e44aaa900630
-
SHA512
d15aa3d6c35ace6c3b022e649d4dec667e00570fca2312bbfb7be55d75fce887cad7e9f73193b5c4a9102766c3af3aab7e1594b2d70993724612f080e0a0fba8
-
SSDEEP
24576:DyofxB/rPoDZxGAOKi+Y/E4TZN1/u4Kg:Wy//8D2wP
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1