General
-
Target
ef62f527e6e06b518b384db105fe879e45d85da54e405a3468c8d35d15a08cdd
-
Size
480KB
-
Sample
241111-he6haaykbj
-
MD5
8f092d674ac8186e6728965cf0bf26b9
-
SHA1
776ed2a14609f1c90988a0194d601b2d56a3ad61
-
SHA256
ef62f527e6e06b518b384db105fe879e45d85da54e405a3468c8d35d15a08cdd
-
SHA512
bb8edf5f4ded68274637197e7fb6e313ca23fb69610d5df48aa2375730eef589bf0901c5514832824b6204e18084ed93d8803287eca4be9dc10bbf49d2cf76ae
-
SSDEEP
6144:KVy+bnr+1p0yN90QE4h32N9r+vQkoQ3Ny8nV05FiHSIIXNXI+Tgza7ChITkQd/L:vMrFy90mh32fSLj9vV0gzYN7cWuRaT
Static task
static1
Behavioral task
behavioral1
Sample
ef62f527e6e06b518b384db105fe879e45d85da54e405a3468c8d35d15a08cdd.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
misfa
217.196.96.101:4132
-
auth_value
be2e6d9f1a5e54a81340947b20e561c1
Targets
-
-
Target
ef62f527e6e06b518b384db105fe879e45d85da54e405a3468c8d35d15a08cdd
-
Size
480KB
-
MD5
8f092d674ac8186e6728965cf0bf26b9
-
SHA1
776ed2a14609f1c90988a0194d601b2d56a3ad61
-
SHA256
ef62f527e6e06b518b384db105fe879e45d85da54e405a3468c8d35d15a08cdd
-
SHA512
bb8edf5f4ded68274637197e7fb6e313ca23fb69610d5df48aa2375730eef589bf0901c5514832824b6204e18084ed93d8803287eca4be9dc10bbf49d2cf76ae
-
SSDEEP
6144:KVy+bnr+1p0yN90QE4h32N9r+vQkoQ3Ny8nV05FiHSIIXNXI+Tgza7ChITkQd/L:vMrFy90mh32fSLj9vV0gzYN7cWuRaT
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1