General
-
Target
488276d4ccc34346e485e1a61c3f2af00848f2923c69010d8c756075135ad4b1
-
Size
792KB
-
Sample
241110-dz9m8axrgt
-
MD5
818b473a31ff3e3f3b80ca238fe60598
-
SHA1
873ebd0c4e75ae0c53b8a47a26d569deb343f4d4
-
SHA256
488276d4ccc34346e485e1a61c3f2af00848f2923c69010d8c756075135ad4b1
-
SHA512
ac9ba75d62d96cd5dc97055183158eecd58a8561f7a8fbcdca56404b461b2053dea98cf4a4c0566614c0d02c34262883711c27073ec1abad1a37a855538c2ef6
-
SSDEEP
12288:iMrgy90QS5lLKVb/0dN/uqvt4Utl3Z2Fxl8O6Vs/QG9WPyHiq7EP2qaPqRLIMd:iyeeVAdIetntlZWZIGeyCqm2qogLv
Static task
static1
Behavioral task
behavioral1
Sample
488276d4ccc34346e485e1a61c3f2af00848f2923c69010d8c756075135ad4b1.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Targets
-
-
Target
488276d4ccc34346e485e1a61c3f2af00848f2923c69010d8c756075135ad4b1
-
Size
792KB
-
MD5
818b473a31ff3e3f3b80ca238fe60598
-
SHA1
873ebd0c4e75ae0c53b8a47a26d569deb343f4d4
-
SHA256
488276d4ccc34346e485e1a61c3f2af00848f2923c69010d8c756075135ad4b1
-
SHA512
ac9ba75d62d96cd5dc97055183158eecd58a8561f7a8fbcdca56404b461b2053dea98cf4a4c0566614c0d02c34262883711c27073ec1abad1a37a855538c2ef6
-
SSDEEP
12288:iMrgy90QS5lLKVb/0dN/uqvt4Utl3Z2Fxl8O6Vs/QG9WPyHiq7EP2qaPqRLIMd:iyeeVAdIetntlZWZIGeyCqm2qogLv
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1