General
-
Target
659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a
-
Size
659KB
-
Sample
241111-gpy1hsthml
-
MD5
f9428e751724949d58f4c9dccdce9ebe
-
SHA1
0d842817e8fd753b9f3d62735a0658ad0753be93
-
SHA256
659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a
-
SHA512
2b1b2a54ec50a0f6104c7729335168efddcf17fffbf208a54627b379454311829a1194c26bc96b039520bc43983d255b483a90bf4b8f4fee6f34d5f359fb4ab3
-
SSDEEP
12288:DMrEy90KoYKcwaq5evC4IRUwP48BcaZS2tzEpW6VR7xO:Xy6Ym5evtIRnP48Bi2tmZVy
Static task
static1
Behavioral task
behavioral1
Sample
659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Targets
-
-
Target
659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a
-
Size
659KB
-
MD5
f9428e751724949d58f4c9dccdce9ebe
-
SHA1
0d842817e8fd753b9f3d62735a0658ad0753be93
-
SHA256
659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a
-
SHA512
2b1b2a54ec50a0f6104c7729335168efddcf17fffbf208a54627b379454311829a1194c26bc96b039520bc43983d255b483a90bf4b8f4fee6f34d5f359fb4ab3
-
SSDEEP
12288:DMrEy90KoYKcwaq5evC4IRUwP48BcaZS2tzEpW6VR7xO:Xy6Ym5evtIRnP48Bi2tmZVy
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1