General
-
Target
b89c4f31f148f386744359d817adab3a53661404853e12c0a49745af8790e53a
-
Size
481KB
-
Sample
241110-bsn2tswgmc
-
MD5
3ee04b4615722be6eb7adf82ae8bb79a
-
SHA1
18dd64f8aade617a07fd5149eb3abda4dd5a0bd5
-
SHA256
b89c4f31f148f386744359d817adab3a53661404853e12c0a49745af8790e53a
-
SHA512
a0e4af0be326a9525017569f5dbb7117b69a1970144950a1983a9495fb52242a2a246284af71150a51b628be3c8bc36836e0a66825046bbaa43f15e8f16d7be8
-
SSDEEP
12288:JMr7y906pn3rx5c1u31dTvwHP2GTi6kdR:iy7p3rfXnTWBxkdR
Static task
static1
Behavioral task
behavioral1
Sample
b89c4f31f148f386744359d817adab3a53661404853e12c0a49745af8790e53a.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
mihan
217.196.96.101:4132
-
auth_value
9a6a8fdae02ed7caa0a49a6ddc6d4520
Targets
-
-
Target
b89c4f31f148f386744359d817adab3a53661404853e12c0a49745af8790e53a
-
Size
481KB
-
MD5
3ee04b4615722be6eb7adf82ae8bb79a
-
SHA1
18dd64f8aade617a07fd5149eb3abda4dd5a0bd5
-
SHA256
b89c4f31f148f386744359d817adab3a53661404853e12c0a49745af8790e53a
-
SHA512
a0e4af0be326a9525017569f5dbb7117b69a1970144950a1983a9495fb52242a2a246284af71150a51b628be3c8bc36836e0a66825046bbaa43f15e8f16d7be8
-
SSDEEP
12288:JMr7y906pn3rx5c1u31dTvwHP2GTi6kdR:iy7p3rfXnTWBxkdR
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1