General
-
Target
81de9a7da280317fd63def4273d19b2c96cef0b0f4802a44d3a7cf184d35e645
-
Size
1.2MB
-
Sample
241110-dt5gbayeke
-
MD5
6f698f48c77fd0055e701abb7a0583d3
-
SHA1
e8de6a8696b15a2cbb3434ed13238a17424612cb
-
SHA256
81de9a7da280317fd63def4273d19b2c96cef0b0f4802a44d3a7cf184d35e645
-
SHA512
5bf85d7c87dc26a1bf3ff9251cdf9d096e7247f623e41f0b50168f5666de6bb5ae2547b525988c63e6c250f32c4ae6f70b37b41a69dc799aba8c9fe4b067796f
-
SSDEEP
24576:WYAVCfN05jEKvD1eqB6QLUIHZinS07gPUSko5622+s:WY1NsVN654ZiE1ko5Q+
Static task
static1
Behavioral task
behavioral1
Sample
81de9a7da280317fd63def4273d19b2c96cef0b0f4802a44d3a7cf184d35e645.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
81de9a7da280317fd63def4273d19b2c96cef0b0f4802a44d3a7cf184d35e645.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
81de9a7da280317fd63def4273d19b2c96cef0b0f4802a44d3a7cf184d35e645
-
Size
1.2MB
-
MD5
6f698f48c77fd0055e701abb7a0583d3
-
SHA1
e8de6a8696b15a2cbb3434ed13238a17424612cb
-
SHA256
81de9a7da280317fd63def4273d19b2c96cef0b0f4802a44d3a7cf184d35e645
-
SHA512
5bf85d7c87dc26a1bf3ff9251cdf9d096e7247f623e41f0b50168f5666de6bb5ae2547b525988c63e6c250f32c4ae6f70b37b41a69dc799aba8c9fe4b067796f
-
SSDEEP
24576:WYAVCfN05jEKvD1eqB6QLUIHZinS07gPUSko5622+s:WY1NsVN654ZiE1ko5Q+
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1