General
-
Target
83aa1c152fa566df19c05b9467c52ac7dce00910c726e598c4b7d18da4f8c3bf
-
Size
548KB
-
Sample
241110-bv5glayrgl
-
MD5
82a7ce1e00dd2bd014a9377728b4bb43
-
SHA1
1d9802d23b7fdd3eb056a4a3d4074261b01397af
-
SHA256
83aa1c152fa566df19c05b9467c52ac7dce00910c726e598c4b7d18da4f8c3bf
-
SHA512
33736400c369cd5a2cf2c797fc559d683ece26c7ba754edc9061330ea69a255160afb763cdc7928759d6f33c104d6308b7bb6547c10d2bfd52ae1b89867ae020
-
SSDEEP
12288:/MrIy90m3dxQZuvCkD+FbIgKV2eRdeDQBnNyTvtK/1:bytGg6yleDQBwvo1
Static task
static1
Behavioral task
behavioral1
Sample
83aa1c152fa566df19c05b9467c52ac7dce00910c726e598c4b7d18da4f8c3bf.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Targets
-
-
Target
83aa1c152fa566df19c05b9467c52ac7dce00910c726e598c4b7d18da4f8c3bf
-
Size
548KB
-
MD5
82a7ce1e00dd2bd014a9377728b4bb43
-
SHA1
1d9802d23b7fdd3eb056a4a3d4074261b01397af
-
SHA256
83aa1c152fa566df19c05b9467c52ac7dce00910c726e598c4b7d18da4f8c3bf
-
SHA512
33736400c369cd5a2cf2c797fc559d683ece26c7ba754edc9061330ea69a255160afb763cdc7928759d6f33c104d6308b7bb6547c10d2bfd52ae1b89867ae020
-
SSDEEP
12288:/MrIy90m3dxQZuvCkD+FbIgKV2eRdeDQBnNyTvtK/1:bytGg6yleDQBwvo1
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1