General
-
Target
0d530e83ba120b222f621d84e0f35f7ac23f8d662ecf029bd21234dafb072bbb
-
Size
1.0MB
-
Sample
241111-ghnwzatgml
-
MD5
e7c72f66ad2ad7a7ec8d32173bb8f0ce
-
SHA1
1840b1442e94ae9443559cbcf59d0628c19481c9
-
SHA256
0d530e83ba120b222f621d84e0f35f7ac23f8d662ecf029bd21234dafb072bbb
-
SHA512
9f4597b7d64b9eafac27963d71e00b000073fb2b97fc151a829123ea4c18d3a7e862cf43a76fd636a0e23ee342692fbf52fa50669e8ee7686bd5175a1d44a677
-
SSDEEP
24576:7qw0OA/oz/04YtRHw/tOWaqbkCimjVkaHtSv8I+h:N0Obw4Yt6OQlimjV3tSvc
Static task
static1
Behavioral task
behavioral1
Sample
0d530e83ba120b222f621d84e0f35f7ac23f8d662ecf029bd21234dafb072bbb.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
0d530e83ba120b222f621d84e0f35f7ac23f8d662ecf029bd21234dafb072bbb.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
0d530e83ba120b222f621d84e0f35f7ac23f8d662ecf029bd21234dafb072bbb
-
Size
1.0MB
-
MD5
e7c72f66ad2ad7a7ec8d32173bb8f0ce
-
SHA1
1840b1442e94ae9443559cbcf59d0628c19481c9
-
SHA256
0d530e83ba120b222f621d84e0f35f7ac23f8d662ecf029bd21234dafb072bbb
-
SHA512
9f4597b7d64b9eafac27963d71e00b000073fb2b97fc151a829123ea4c18d3a7e862cf43a76fd636a0e23ee342692fbf52fa50669e8ee7686bd5175a1d44a677
-
SSDEEP
24576:7qw0OA/oz/04YtRHw/tOWaqbkCimjVkaHtSv8I+h:N0Obw4Yt6OQlimjV3tSvc
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1