General
-
Target
226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77
-
Size
809KB
-
Sample
241110-b6t51azlbr
-
MD5
8cfc23acc4b7244de4787364ea539a8b
-
SHA1
80b06e9196e4a70ec69b4dc49b42b805bcef3144
-
SHA256
226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77
-
SHA512
8be27c6b49b94fe588c43f2ff0b00d9a29a7bd7224c24a2591af98cf5e1df091caaf0605d9f2f1471f1b228272a5c9647d3b1ac60b0c916edc7864d228dd745c
-
SSDEEP
24576:DymAvW/b1LCDCY7QDGAGEjcJGuvflKOOMG1:WpvsbpdftjKG8fHP
Static task
static1
Behavioral task
behavioral1
Sample
226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
dubka
193.233.20.13:4136
-
auth_value
e5a9421183a033f283b2f23139b471f0
Targets
-
-
Target
226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77
-
Size
809KB
-
MD5
8cfc23acc4b7244de4787364ea539a8b
-
SHA1
80b06e9196e4a70ec69b4dc49b42b805bcef3144
-
SHA256
226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77
-
SHA512
8be27c6b49b94fe588c43f2ff0b00d9a29a7bd7224c24a2591af98cf5e1df091caaf0605d9f2f1471f1b228272a5c9647d3b1ac60b0c916edc7864d228dd745c
-
SSDEEP
24576:DymAvW/b1LCDCY7QDGAGEjcJGuvflKOOMG1:WpvsbpdftjKG8fHP
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1