General
-
Target
7057c5b820e32ecc3e8a8f07cbc7f7cd93165b00f19ef85c0c6f4556ada1c9b6
-
Size
693KB
-
Sample
241110-bs9zaswjaz
-
MD5
7f324fb5d7febf14003c308e68b21465
-
SHA1
7fc5fe515ce585b516d5aeea9b6e40e772e174eb
-
SHA256
7057c5b820e32ecc3e8a8f07cbc7f7cd93165b00f19ef85c0c6f4556ada1c9b6
-
SHA512
1167706e37c93ecc40ea12480c8196f0d1579236ef94f4c8f7cb0cffad38a9cc7781329da47a02eb78221e98c6b0cc8634dab0a43faba0c74c3ba799da513075
-
SSDEEP
12288:6MrIy90DDeyywSmKuf+K2+FtBg0wimcgQxDGwEOPa8crbl/EsXaA8:WyUDey2uWb+FtBgomw+Tbl/t8
Static task
static1
Behavioral task
behavioral1
Sample
7057c5b820e32ecc3e8a8f07cbc7f7cd93165b00f19ef85c0c6f4556ada1c9b6.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Targets
-
-
Target
7057c5b820e32ecc3e8a8f07cbc7f7cd93165b00f19ef85c0c6f4556ada1c9b6
-
Size
693KB
-
MD5
7f324fb5d7febf14003c308e68b21465
-
SHA1
7fc5fe515ce585b516d5aeea9b6e40e772e174eb
-
SHA256
7057c5b820e32ecc3e8a8f07cbc7f7cd93165b00f19ef85c0c6f4556ada1c9b6
-
SHA512
1167706e37c93ecc40ea12480c8196f0d1579236ef94f4c8f7cb0cffad38a9cc7781329da47a02eb78221e98c6b0cc8634dab0a43faba0c74c3ba799da513075
-
SSDEEP
12288:6MrIy90DDeyywSmKuf+K2+FtBg0wimcgQxDGwEOPa8crbl/EsXaA8:WyUDey2uWb+FtBgomw+Tbl/t8
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1