General
-
Target
6c62f327170c49ae59333d30c0d86b1a198f0cb0a89ecb50a7bcdbe6172e7ff2N.exe
-
Size
405KB
-
Sample
241111-pa23mazbjh
-
MD5
c15b7aa840dc8e51d0802cf5360268c7
-
SHA1
89bf6ca68528ca86e950338495af99571181c190
-
SHA256
7095a6194e1da6918f0aefe7ab20077c8a7de9678e8d09c282b65cbbf2e79c82
-
SHA512
8fd3c9694143adb8a6559aa728224111729c1e65493c636205e2d685de384c7e6a00b5b6a7cdca0ef5d9d05535acf4d8c06a6de52df06879a9efaf17824b6e6f
-
SSDEEP
6144:KZy+bnr+rp0yN90QEH5MPKC0QrUKxg2jHux1CDe8jzQGt316caMkoqc9OCC48:bMrLy90t5MPKBRpSjzQ80eTjICP8
Static task
static1
Behavioral task
behavioral1
Sample
6c62f327170c49ae59333d30c0d86b1a198f0cb0a89ecb50a7bcdbe6172e7ff2N.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Targets
-
-
Target
6c62f327170c49ae59333d30c0d86b1a198f0cb0a89ecb50a7bcdbe6172e7ff2N.exe
-
Size
405KB
-
MD5
c15b7aa840dc8e51d0802cf5360268c7
-
SHA1
89bf6ca68528ca86e950338495af99571181c190
-
SHA256
7095a6194e1da6918f0aefe7ab20077c8a7de9678e8d09c282b65cbbf2e79c82
-
SHA512
8fd3c9694143adb8a6559aa728224111729c1e65493c636205e2d685de384c7e6a00b5b6a7cdca0ef5d9d05535acf4d8c06a6de52df06879a9efaf17824b6e6f
-
SSDEEP
6144:KZy+bnr+rp0yN90QEH5MPKC0QrUKxg2jHux1CDe8jzQGt316caMkoqc9OCC48:bMrLy90t5MPKBRpSjzQ80eTjICP8
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1