General
-
Target
b3ce974333fe96641883a772128a531766c3ca9a61215a54482c6f5efcd00757
-
Size
392KB
-
Sample
241111-h88vhavhll
-
MD5
8c915dee6adc6284d31736219258249d
-
SHA1
6740576bcbdf48bb52fa98a4ec0e610fafe7e067
-
SHA256
b3ce974333fe96641883a772128a531766c3ca9a61215a54482c6f5efcd00757
-
SHA512
31f2d66d1dfba2d1c0f688229d4b2bf855176c771dd0d6953d37d09ccf199a9cc6299b94d4f4cf723d3b8428c8c8a4ed3309610392e6e1b63a508504eb7d1d59
-
SSDEEP
6144:KWy+bnr+Zp0yN90QEoaLeaUAjviz02E9+zqBbQlbJVeAJT8zl/D4aolh6/:iMrhy90JeaUAjY029aQp0zWa/
Static task
static1
Behavioral task
behavioral1
Sample
b3ce974333fe96641883a772128a531766c3ca9a61215a54482c6f5efcd00757.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Targets
-
-
Target
b3ce974333fe96641883a772128a531766c3ca9a61215a54482c6f5efcd00757
-
Size
392KB
-
MD5
8c915dee6adc6284d31736219258249d
-
SHA1
6740576bcbdf48bb52fa98a4ec0e610fafe7e067
-
SHA256
b3ce974333fe96641883a772128a531766c3ca9a61215a54482c6f5efcd00757
-
SHA512
31f2d66d1dfba2d1c0f688229d4b2bf855176c771dd0d6953d37d09ccf199a9cc6299b94d4f4cf723d3b8428c8c8a4ed3309610392e6e1b63a508504eb7d1d59
-
SSDEEP
6144:KWy+bnr+Zp0yN90QEoaLeaUAjviz02E9+zqBbQlbJVeAJT8zl/D4aolh6/:iMrhy90JeaUAjY029aQp0zWa/
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1