General
-
Target
c5874a121165417113c618ca382a6cc706030973224b806194a562b7eff4376cN.exe
-
Size
202KB
-
Sample
241111-hfgkjstpfx
-
MD5
9d8ac56fc0e3ed7cc0d4af1bc0995fd0
-
SHA1
81d024a75775bed598bb809c9860edf0df6c18ae
-
SHA256
3252840cb9af46cb8f45667fcd82ad46780962a9ad507fb57473623072e57fed
-
SHA512
4589012250e924041872c77ac32bb477fddfaf07f7dad6b3f6fce3404f115d5ba9bf42342c716f9cdc5c2bfe60dc44f409d9652dd92bbfa35344fd36daada311
-
SSDEEP
3072:Kwy+bnr+O1H5GWp1icKAArDZz4N9GhbkrNEk6lYSSR2U2Um1qelY1V:Kwy+bnr+gp0yN90QE+/bz
Static task
static1
Behavioral task
behavioral1
Sample
c5874a121165417113c618ca382a6cc706030973224b806194a562b7eff4376cN.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
dubik
193.233.20.17:4139
-
auth_value
05136deb26ad700ca57d43b1de454f46
Targets
-
-
Target
c5874a121165417113c618ca382a6cc706030973224b806194a562b7eff4376cN.exe
-
Size
202KB
-
MD5
9d8ac56fc0e3ed7cc0d4af1bc0995fd0
-
SHA1
81d024a75775bed598bb809c9860edf0df6c18ae
-
SHA256
3252840cb9af46cb8f45667fcd82ad46780962a9ad507fb57473623072e57fed
-
SHA512
4589012250e924041872c77ac32bb477fddfaf07f7dad6b3f6fce3404f115d5ba9bf42342c716f9cdc5c2bfe60dc44f409d9652dd92bbfa35344fd36daada311
-
SSDEEP
3072:Kwy+bnr+O1H5GWp1icKAArDZz4N9GhbkrNEk6lYSSR2U2Um1qelY1V:Kwy+bnr+gp0yN90QE+/bz
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1