General
-
Target
0684e939179e4f8f6c3253007dee3938a265f24388a1cc5ed4964380cc8ad59b
-
Size
404KB
-
Sample
241112-x1yrwszakg
-
MD5
8a6b81a5f2b8bfb1edaac36cddf9be7f
-
SHA1
aaee253f201a419a7467cf9f148ff46d927d5cd4
-
SHA256
0684e939179e4f8f6c3253007dee3938a265f24388a1cc5ed4964380cc8ad59b
-
SHA512
d00df81f9be59b6059d3e578da917cc012c03dda9ffe04fb9ccd9603a90c5b3d74937ee146e109561bf3945418a33fb6b77be004491cb5d0bb63032ebe2c3f09
-
SSDEEP
6144:KAy+bnr+0p0yN90QEtFoH9Af4M/3qbO7NPuEW8SWCJD0Lj7xZDl+LBB:kMrgy90JoH9LQKcstHwLnDgL
Static task
static1
Behavioral task
behavioral1
Sample
0684e939179e4f8f6c3253007dee3938a265f24388a1cc5ed4964380cc8ad59b.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Targets
-
-
Target
0684e939179e4f8f6c3253007dee3938a265f24388a1cc5ed4964380cc8ad59b
-
Size
404KB
-
MD5
8a6b81a5f2b8bfb1edaac36cddf9be7f
-
SHA1
aaee253f201a419a7467cf9f148ff46d927d5cd4
-
SHA256
0684e939179e4f8f6c3253007dee3938a265f24388a1cc5ed4964380cc8ad59b
-
SHA512
d00df81f9be59b6059d3e578da917cc012c03dda9ffe04fb9ccd9603a90c5b3d74937ee146e109561bf3945418a33fb6b77be004491cb5d0bb63032ebe2c3f09
-
SSDEEP
6144:KAy+bnr+0p0yN90QEtFoH9Af4M/3qbO7NPuEW8SWCJD0Lj7xZDl+LBB:kMrgy90JoH9LQKcstHwLnDgL
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1