General
-
Target
b819751d290a84ebe026a1753510f7cac97ec1d21d55cff388a575793ed6c8be
-
Size
527KB
-
Sample
241110-dv8v5a1phl
-
MD5
eb85a7fd2db3c1ce38233045adbfa01c
-
SHA1
e2b636d4561adaff53ac6973e5c0b8f2b2f1ecde
-
SHA256
b819751d290a84ebe026a1753510f7cac97ec1d21d55cff388a575793ed6c8be
-
SHA512
f7b633872ae003fb37002349ef6702ca6430a763e604120b1c50fc882ef76f1d968198b0b387740ab266f298a068102ae82a09317c5c857fadf7d9969db81d98
-
SSDEEP
12288:9MrEy90sYm0GpYUIRwhOKFw8XMhh//F8/w4d6SY:RyqmTpPIRmFaNowS6l
Static task
static1
Behavioral task
behavioral1
Sample
b819751d290a84ebe026a1753510f7cac97ec1d21d55cff388a575793ed6c8be.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
ronam
193.233.20.17:4139
-
auth_value
125421d19d14dd7fd211bc7f6d4aea6c
Targets
-
-
Target
b819751d290a84ebe026a1753510f7cac97ec1d21d55cff388a575793ed6c8be
-
Size
527KB
-
MD5
eb85a7fd2db3c1ce38233045adbfa01c
-
SHA1
e2b636d4561adaff53ac6973e5c0b8f2b2f1ecde
-
SHA256
b819751d290a84ebe026a1753510f7cac97ec1d21d55cff388a575793ed6c8be
-
SHA512
f7b633872ae003fb37002349ef6702ca6430a763e604120b1c50fc882ef76f1d968198b0b387740ab266f298a068102ae82a09317c5c857fadf7d9969db81d98
-
SSDEEP
12288:9MrEy90sYm0GpYUIRwhOKFw8XMhh//F8/w4d6SY:RyqmTpPIRmFaNowS6l
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1