General
-
Target
7ab435a8e3b22164b83c26cc846cbd369b1631df08dbba7cd1ce4e0a38ce17ba
-
Size
550KB
-
Sample
241110-cga69szmhk
-
MD5
43d8b0841c280be59e7d4e555f7536f2
-
SHA1
182fb23ce02dda185d0bc422a09d9f16d0ce7e20
-
SHA256
7ab435a8e3b22164b83c26cc846cbd369b1631df08dbba7cd1ce4e0a38ce17ba
-
SHA512
5204ee04b063308d657aa9176226f7892bded71d59f0a9854a75758894b1a5d6c69f483df89f20fb4d25f42025d319a269a3c71eaefcad24ed6f993d7ca9142f
-
SSDEEP
12288:xMrGy907/9dFxiuMiQzLRoSBFQQJYhejrg6z78tF6N+ODj5hPv:zyCdFAjbfYOrd3867/5h3
Static task
static1
Behavioral task
behavioral1
Sample
7ab435a8e3b22164b83c26cc846cbd369b1631df08dbba7cd1ce4e0a38ce17ba.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
stek
melevv.eu:4162
-
auth_value
4205381daf6946b2df5fe3bc7eacc918
Targets
-
-
Target
7ab435a8e3b22164b83c26cc846cbd369b1631df08dbba7cd1ce4e0a38ce17ba
-
Size
550KB
-
MD5
43d8b0841c280be59e7d4e555f7536f2
-
SHA1
182fb23ce02dda185d0bc422a09d9f16d0ce7e20
-
SHA256
7ab435a8e3b22164b83c26cc846cbd369b1631df08dbba7cd1ce4e0a38ce17ba
-
SHA512
5204ee04b063308d657aa9176226f7892bded71d59f0a9854a75758894b1a5d6c69f483df89f20fb4d25f42025d319a269a3c71eaefcad24ed6f993d7ca9142f
-
SSDEEP
12288:xMrGy907/9dFxiuMiQzLRoSBFQQJYhejrg6z78tF6N+ODj5hPv:zyCdFAjbfYOrd3867/5h3
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1