General
-
Target
a9f3e683ed19081250f148e4bdeb54f25add8e11a879eb8abda99e11f5c87b2c.exe
-
Size
202KB
-
Sample
241113-rpexrawrdj
-
MD5
c37bb66fd71b55aefe729b62552dbe1a
-
SHA1
4bf1170612661b8b0c4d8dce249a8a1e9325bf5d
-
SHA256
a9f3e683ed19081250f148e4bdeb54f25add8e11a879eb8abda99e11f5c87b2c
-
SHA512
986344cb324067e6888230207501332d5b64f9a41e4b6a2b0d2cd63edaa4dfef9bf3b176757a6b79439b568deb5374069aa960f00c593db886c0879561abf27c
-
SSDEEP
3072:KGy+bnr+O1a5GWp1icKAArDZz4N9GhbkrNEk6oYSSR2U2Um1qolY1p:KGy+bnr+hp0yN90QEp/l/
Static task
static1
Behavioral task
behavioral1
Sample
a9f3e683ed19081250f148e4bdeb54f25add8e11a879eb8abda99e11f5c87b2c.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
dubik
193.233.20.17:4139
-
auth_value
05136deb26ad700ca57d43b1de454f46
Targets
-
-
Target
a9f3e683ed19081250f148e4bdeb54f25add8e11a879eb8abda99e11f5c87b2c.exe
-
Size
202KB
-
MD5
c37bb66fd71b55aefe729b62552dbe1a
-
SHA1
4bf1170612661b8b0c4d8dce249a8a1e9325bf5d
-
SHA256
a9f3e683ed19081250f148e4bdeb54f25add8e11a879eb8abda99e11f5c87b2c
-
SHA512
986344cb324067e6888230207501332d5b64f9a41e4b6a2b0d2cd63edaa4dfef9bf3b176757a6b79439b568deb5374069aa960f00c593db886c0879561abf27c
-
SSDEEP
3072:KGy+bnr+O1a5GWp1icKAArDZz4N9GhbkrNEk6oYSSR2U2Um1qolY1p:KGy+bnr+hp0yN90QEp/l/
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1