General
-
Target
ca942b7355c8da6ba53007cd8342be16fd4466a1d68ab4b891a850ce077fba41
-
Size
1.1MB
-
Sample
241110-asjxfavhll
-
MD5
4451959b003f4e9084b7fef3006fdb10
-
SHA1
e6e9c7c411f0816eead48df328198bf97aa9bb5b
-
SHA256
ca942b7355c8da6ba53007cd8342be16fd4466a1d68ab4b891a850ce077fba41
-
SHA512
ad007a46ba851819713795676a4ba46a51b3c11d7a154f67211afa8155d579b9cfe377b00b7913a86973c09753fdb81aa631d2a60062a96b2ed5e64d47528de9
-
SSDEEP
24576:2ySljx+EzDcMJ4TPv5AFg2BJQD6X2ZMQphdZkucsunpOK1e:FSl9+gDcMJCPv5sQD6GZ9yucTpO
Static task
static1
Behavioral task
behavioral1
Sample
ca942b7355c8da6ba53007cd8342be16fd4466a1d68ab4b891a850ce077fba41.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
ramon
193.233.20.23:4123
-
auth_value
3197576965d9513f115338c233015b40
Targets
-
-
Target
ca942b7355c8da6ba53007cd8342be16fd4466a1d68ab4b891a850ce077fba41
-
Size
1.1MB
-
MD5
4451959b003f4e9084b7fef3006fdb10
-
SHA1
e6e9c7c411f0816eead48df328198bf97aa9bb5b
-
SHA256
ca942b7355c8da6ba53007cd8342be16fd4466a1d68ab4b891a850ce077fba41
-
SHA512
ad007a46ba851819713795676a4ba46a51b3c11d7a154f67211afa8155d579b9cfe377b00b7913a86973c09753fdb81aa631d2a60062a96b2ed5e64d47528de9
-
SSDEEP
24576:2ySljx+EzDcMJ4TPv5AFg2BJQD6X2ZMQphdZkucsunpOK1e:FSl9+gDcMJCPv5sQD6GZ9yucTpO
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1