General
-
Target
749fc338e27160fd4d1bd43187e449dfd92f2552f0feb6405128eaa7da2c45da
-
Size
479KB
-
Sample
241110-b2e6aawkfx
-
MD5
7c19f24c815f3bb38fe4958153a69b5a
-
SHA1
1616a4c4e6bd8c274b6566c8186ace089bacaee1
-
SHA256
749fc338e27160fd4d1bd43187e449dfd92f2552f0feb6405128eaa7da2c45da
-
SHA512
33790b6a1bf22fa9fa10780c7c06d31fbe8195fbef49deb793e6f5f1c9ca000063a9314639bc098a19b3ac67848f7083e8e2b224604270a8ccb75ee2be245256
-
SSDEEP
12288:IMray90Q/2bWFzFZCX1lDBYOgsa7SBu00fkKA:yyAWpDCFtiOgHyu2KA
Static task
static1
Behavioral task
behavioral1
Sample
749fc338e27160fd4d1bd43187e449dfd92f2552f0feb6405128eaa7da2c45da.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
dona
217.196.96.101:4132
-
auth_value
9fbb198992bbc83a84ab1f21384813e3
Targets
-
-
Target
749fc338e27160fd4d1bd43187e449dfd92f2552f0feb6405128eaa7da2c45da
-
Size
479KB
-
MD5
7c19f24c815f3bb38fe4958153a69b5a
-
SHA1
1616a4c4e6bd8c274b6566c8186ace089bacaee1
-
SHA256
749fc338e27160fd4d1bd43187e449dfd92f2552f0feb6405128eaa7da2c45da
-
SHA512
33790b6a1bf22fa9fa10780c7c06d31fbe8195fbef49deb793e6f5f1c9ca000063a9314639bc098a19b3ac67848f7083e8e2b224604270a8ccb75ee2be245256
-
SSDEEP
12288:IMray90Q/2bWFzFZCX1lDBYOgsa7SBu00fkKA:yyAWpDCFtiOgHyu2KA
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1