General
-
Target
a5576efd86527570af773be32e81e13c6f800a01b37c70d2e4d5870247776af4
-
Size
723KB
-
Sample
241110-bpap2awfnf
-
MD5
f40ea43b07ba9a99a46a16f417f39f30
-
SHA1
93f3a3ac48aa06121901017d93451b1427bd2b30
-
SHA256
a5576efd86527570af773be32e81e13c6f800a01b37c70d2e4d5870247776af4
-
SHA512
f1a3d23623ae3fa9c647518b09ed7b80d58ed61c025120197cdeda8f1705394a0754321cecb5bf4e23ecd5fd811e9d4b78f33e4cf5ca31bf583ba9c8262950bf
-
SSDEEP
12288:tMrwy90+wX9MPF1JxREmxlJ/6vu/7QrYZg8+QnZfnttOuhQBHyxfGM2TRZ3e:FygCPFTxzd6vu/7la1mZftnhQlUGMcZu
Static task
static1
Behavioral task
behavioral1
Sample
a5576efd86527570af773be32e81e13c6f800a01b37c70d2e4d5870247776af4.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diza
185.161.248.90:4125
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Targets
-
-
Target
a5576efd86527570af773be32e81e13c6f800a01b37c70d2e4d5870247776af4
-
Size
723KB
-
MD5
f40ea43b07ba9a99a46a16f417f39f30
-
SHA1
93f3a3ac48aa06121901017d93451b1427bd2b30
-
SHA256
a5576efd86527570af773be32e81e13c6f800a01b37c70d2e4d5870247776af4
-
SHA512
f1a3d23623ae3fa9c647518b09ed7b80d58ed61c025120197cdeda8f1705394a0754321cecb5bf4e23ecd5fd811e9d4b78f33e4cf5ca31bf583ba9c8262950bf
-
SSDEEP
12288:tMrwy90+wX9MPF1JxREmxlJ/6vu/7QrYZg8+QnZfnttOuhQBHyxfGM2TRZ3e:FygCPFTxzd6vu/7la1mZftnhQlUGMcZu
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1