General
-
Target
9b9bf5c19c528282e0c88ecc3b36e181b6d8f38b6f7a9f766dd37f1bdb64a7ed
-
Size
689KB
-
Sample
241111-hpf1davemn
-
MD5
cbfde2223c428839f0b4c13e2fa5a109
-
SHA1
d2713ab644c72d0394befdc1b11cb76dc0c63c7c
-
SHA256
9b9bf5c19c528282e0c88ecc3b36e181b6d8f38b6f7a9f766dd37f1bdb64a7ed
-
SHA512
3dee57201a7dbbea23cd5bd5b56c5c783e9af95586e6fb7bc5f58007686e92f873644127256efd5a3fcf46bd2e821d8b35136ce5e8c5875280d31bcbda748714
-
SSDEEP
12288:EMrKy903+6TK78iqaZIpCkdzLngimYh1oID43xBYMOKbcxXolf+IAhQDHXps7:+yr4XU1kdzLn51fD4hiMTIx4QoHXps7
Static task
static1
Behavioral task
behavioral1
Sample
9b9bf5c19c528282e0c88ecc3b36e181b6d8f38b6f7a9f766dd37f1bdb64a7ed.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Targets
-
-
Target
9b9bf5c19c528282e0c88ecc3b36e181b6d8f38b6f7a9f766dd37f1bdb64a7ed
-
Size
689KB
-
MD5
cbfde2223c428839f0b4c13e2fa5a109
-
SHA1
d2713ab644c72d0394befdc1b11cb76dc0c63c7c
-
SHA256
9b9bf5c19c528282e0c88ecc3b36e181b6d8f38b6f7a9f766dd37f1bdb64a7ed
-
SHA512
3dee57201a7dbbea23cd5bd5b56c5c783e9af95586e6fb7bc5f58007686e92f873644127256efd5a3fcf46bd2e821d8b35136ce5e8c5875280d31bcbda748714
-
SSDEEP
12288:EMrKy903+6TK78iqaZIpCkdzLngimYh1oID43xBYMOKbcxXolf+IAhQDHXps7:+yr4XU1kdzLn51fD4hiMTIx4QoHXps7
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1