General
-
Target
29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce
-
Size
1.0MB
-
Sample
241110-bsqweswfjn
-
MD5
a8bb23d16981699d62f05f7fd8e729c6
-
SHA1
0d987d05d1bd728ff18f1d10d12e9fe49dd3caf4
-
SHA256
29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce
-
SHA512
995314d91cc35532aaefa408c4cfb6285834ef860420f523c3994f0648914bebc19de813305d2cb24c2fc924690f3ba0e88960089f40e4fd687ea11c5275b23f
-
SSDEEP
24576:DyiC7piXFKHIyBcefvm1cVm84qY8bX+00W:WiCVsF49YH8Q8j
Static task
static1
Behavioral task
behavioral1
Sample
29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diza
185.161.248.90:4125
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Targets
-
-
Target
29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce
-
Size
1.0MB
-
MD5
a8bb23d16981699d62f05f7fd8e729c6
-
SHA1
0d987d05d1bd728ff18f1d10d12e9fe49dd3caf4
-
SHA256
29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce
-
SHA512
995314d91cc35532aaefa408c4cfb6285834ef860420f523c3994f0648914bebc19de813305d2cb24c2fc924690f3ba0e88960089f40e4fd687ea11c5275b23f
-
SSDEEP
24576:DyiC7piXFKHIyBcefvm1cVm84qY8bX+00W:WiCVsF49YH8Q8j
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1