General
-
Target
e47b3c1321018ed6f7099724b15dbf0b4c8c7219034e88da0bb75c020895a303
-
Size
656KB
-
Sample
241110-djvt5ayckb
-
MD5
566f8ee37d350bccce387abce35e5f9a
-
SHA1
6d3e61f73c8c7489de3b2d94d7c1ccf0e9cec1d4
-
SHA256
e47b3c1321018ed6f7099724b15dbf0b4c8c7219034e88da0bb75c020895a303
-
SHA512
d0cce0210ac7391171501d4def8207b5a1edaca60775980e6f0036ead483be3192455e0118022649e6cdc170817238125e3e16dfb00cf8e967844f1a95aea6b1
-
SSDEEP
12288:IMr3y90skVuSOjw9IQZFa7xaF/SpcRW64p9iM+3ZVSe:PyUVupjzQba78F897e
Static task
static1
Behavioral task
behavioral1
Sample
e47b3c1321018ed6f7099724b15dbf0b4c8c7219034e88da0bb75c020895a303.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
lint
193.233.20.28:4125
-
auth_value
0e95262fb78243c67430f3148303e5b7
Targets
-
-
Target
e47b3c1321018ed6f7099724b15dbf0b4c8c7219034e88da0bb75c020895a303
-
Size
656KB
-
MD5
566f8ee37d350bccce387abce35e5f9a
-
SHA1
6d3e61f73c8c7489de3b2d94d7c1ccf0e9cec1d4
-
SHA256
e47b3c1321018ed6f7099724b15dbf0b4c8c7219034e88da0bb75c020895a303
-
SHA512
d0cce0210ac7391171501d4def8207b5a1edaca60775980e6f0036ead483be3192455e0118022649e6cdc170817238125e3e16dfb00cf8e967844f1a95aea6b1
-
SSDEEP
12288:IMr3y90skVuSOjw9IQZFa7xaF/SpcRW64p9iM+3ZVSe:PyUVupjzQba78F897e
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1