General
-
Target
7d8c2c1c193aa7d01c6b6710ba7112e768a7771c00c04ea99fe818b401dc0e8d
-
Size
479KB
-
Sample
241110-bqds3swenn
-
MD5
3d36b1f2e6e46d54c8add5f5a8b09c5f
-
SHA1
3b2d63eef07a3910d319d5a83a4980c1df8d93db
-
SHA256
7d8c2c1c193aa7d01c6b6710ba7112e768a7771c00c04ea99fe818b401dc0e8d
-
SHA512
53cc6efe9c0b20684605186a042b13f605ae1083269b16148c4cce354f6552c6505820eaca83ffcb74251423617cf200c3e17a90a799ba38c46d890e7dac580f
-
SSDEEP
12288:6Mr+y90Ii3lwe7IbVzNcJKoxTMZ+M2S/p:IyXiOiuBK/FVM
Static task
static1
Behavioral task
behavioral1
Sample
7d8c2c1c193aa7d01c6b6710ba7112e768a7771c00c04ea99fe818b401dc0e8d.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
ditro
217.196.96.101:4132
-
auth_value
8f24ed370a9b24aa28d3d634ea57912e
Targets
-
-
Target
7d8c2c1c193aa7d01c6b6710ba7112e768a7771c00c04ea99fe818b401dc0e8d
-
Size
479KB
-
MD5
3d36b1f2e6e46d54c8add5f5a8b09c5f
-
SHA1
3b2d63eef07a3910d319d5a83a4980c1df8d93db
-
SHA256
7d8c2c1c193aa7d01c6b6710ba7112e768a7771c00c04ea99fe818b401dc0e8d
-
SHA512
53cc6efe9c0b20684605186a042b13f605ae1083269b16148c4cce354f6552c6505820eaca83ffcb74251423617cf200c3e17a90a799ba38c46d890e7dac580f
-
SSDEEP
12288:6Mr+y90Ii3lwe7IbVzNcJKoxTMZ+M2S/p:IyXiOiuBK/FVM
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1