General
-
Target
d9a4034bc566e6f34654dcec8a8d515115951f8f4bbbca8cca518679c9de1dbaN.exe
-
Size
202KB
-
Sample
241113-n876vssalr
-
MD5
bea124026326589c9419a0a9d2c84500
-
SHA1
abc8166bbc926bde760ecedb88d2acfc8b779e78
-
SHA256
d9a4034bc566e6f34654dcec8a8d515115951f8f4bbbca8cca518679c9de1dba
-
SHA512
eba5909b6e8995e9c864e5c17c105c6e8f9844151368a50c7931d643f6e9fa8b2811b03b93f54267b3c44b33f37d44b61abd916603b9106093cd7b4e549ee9f3
-
SSDEEP
3072:KSy+bnr+O1T5GWp1icKAArDZz4N9GhbkrNEk6qYSSR2U2Um1q4lY1:KSy+bnr+Ep0yN90QEr/1
Static task
static1
Behavioral task
behavioral1
Sample
d9a4034bc566e6f34654dcec8a8d515115951f8f4bbbca8cca518679c9de1dbaN.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
dubik
193.233.20.17:4139
-
auth_value
05136deb26ad700ca57d43b1de454f46
Targets
-
-
Target
d9a4034bc566e6f34654dcec8a8d515115951f8f4bbbca8cca518679c9de1dbaN.exe
-
Size
202KB
-
MD5
bea124026326589c9419a0a9d2c84500
-
SHA1
abc8166bbc926bde760ecedb88d2acfc8b779e78
-
SHA256
d9a4034bc566e6f34654dcec8a8d515115951f8f4bbbca8cca518679c9de1dba
-
SHA512
eba5909b6e8995e9c864e5c17c105c6e8f9844151368a50c7931d643f6e9fa8b2811b03b93f54267b3c44b33f37d44b61abd916603b9106093cd7b4e549ee9f3
-
SSDEEP
3072:KSy+bnr+O1T5GWp1icKAArDZz4N9GhbkrNEk6qYSSR2U2Um1q4lY1:KSy+bnr+Ep0yN90QEr/1
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1