General
-
Target
e2aeb4869bcea798c1cd28a4122c4395479725e281328992b97b7023daf61a87
-
Size
660KB
-
Sample
241111-gt28qsvdjc
-
MD5
36795aeaa436bc4cd06b02c45fac35c8
-
SHA1
ecc3cc1338283f59a83042487d341f7982010ebc
-
SHA256
e2aeb4869bcea798c1cd28a4122c4395479725e281328992b97b7023daf61a87
-
SHA512
10a459a7e845f9e170df51e788314c28aea5dce514e1603dde7eb0d832973415110efedd1e4efef7c6d20f94b0daa18532f1eff8967ba0dacbf4875b9c31b18d
-
SSDEEP
12288:SMr0y90sF8JNX+Htulg2k25mFC87QaM4OH0227cKy7SDxp:qynObuMlg7fRQab4r277tH
Static task
static1
Behavioral task
behavioral1
Sample
e2aeb4869bcea798c1cd28a4122c4395479725e281328992b97b7023daf61a87.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Targets
-
-
Target
e2aeb4869bcea798c1cd28a4122c4395479725e281328992b97b7023daf61a87
-
Size
660KB
-
MD5
36795aeaa436bc4cd06b02c45fac35c8
-
SHA1
ecc3cc1338283f59a83042487d341f7982010ebc
-
SHA256
e2aeb4869bcea798c1cd28a4122c4395479725e281328992b97b7023daf61a87
-
SHA512
10a459a7e845f9e170df51e788314c28aea5dce514e1603dde7eb0d832973415110efedd1e4efef7c6d20f94b0daa18532f1eff8967ba0dacbf4875b9c31b18d
-
SSDEEP
12288:SMr0y90sF8JNX+Htulg2k25mFC87QaM4OH0227cKy7SDxp:qynObuMlg7fRQab4r277tH
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1