General
-
Target
57ad4ebec76047e3786ae119a4552b19642c69708624a5b042b9ecca75114845
-
Size
1.0MB
-
Sample
241110-b2ql1swkgx
-
MD5
c40866b8cc6324b234958d8611de3e61
-
SHA1
63616736d158ec488652d6289e0ec2fbc00ed4d5
-
SHA256
57ad4ebec76047e3786ae119a4552b19642c69708624a5b042b9ecca75114845
-
SHA512
bd83daccd4974d4a1bbd0d8eeea5f7fd0f88772737bebac6dcdac4e59a640a366c8705161b25b66bc0a4093fe1e2ec7d5a6183d5f7e9010db1cc71aeecad6493
-
SSDEEP
24576:OyCynJOQej1KL4n2f9bXADxrkcUMhcqx5HZFiq:d9nJgjw0ybXI6cUM+S5HZF
Static task
static1
Behavioral task
behavioral1
Sample
57ad4ebec76047e3786ae119a4552b19642c69708624a5b042b9ecca75114845.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Targets
-
-
Target
57ad4ebec76047e3786ae119a4552b19642c69708624a5b042b9ecca75114845
-
Size
1.0MB
-
MD5
c40866b8cc6324b234958d8611de3e61
-
SHA1
63616736d158ec488652d6289e0ec2fbc00ed4d5
-
SHA256
57ad4ebec76047e3786ae119a4552b19642c69708624a5b042b9ecca75114845
-
SHA512
bd83daccd4974d4a1bbd0d8eeea5f7fd0f88772737bebac6dcdac4e59a640a366c8705161b25b66bc0a4093fe1e2ec7d5a6183d5f7e9010db1cc71aeecad6493
-
SSDEEP
24576:OyCynJOQej1KL4n2f9bXADxrkcUMhcqx5HZFiq:d9nJgjw0ybXI6cUM+S5HZF
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1