General
-
Target
d1c87259d8611552bfcad0b0de13a0d3778b55948d70786cdc818f2b4e1da612N
-
Size
391KB
-
Sample
241113-y1gn2sydkc
-
MD5
d4fc2582d2215c1f86cfd80e0263bab0
-
SHA1
d877f78cb5461cbf4f4f2d30300f10d8174cee55
-
SHA256
d1c87259d8611552bfcad0b0de13a0d3778b55948d70786cdc818f2b4e1da612
-
SHA512
5a4937d5a2568da4ebbeaf0286130e3bab37584c9cd4112e81d3e64048b3170c09cebf0e57adf9f9d8c9fcccf9530a4bcff5486bc2c64d88e6f64ab145f0822f
-
SSDEEP
6144:Kty+bnr+jp0yN90QEcplgwSI8tYD1LjDXjqm7lA11Qh:PMrzy90QSI8G9j5eQh
Static task
static1
Behavioral task
behavioral1
Sample
d1c87259d8611552bfcad0b0de13a0d3778b55948d70786cdc818f2b4e1da612N.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
rumfa
193.233.20.24:4123
-
auth_value
749d02a6b4ef1fa2ad908e44ec2296dc
Targets
-
-
Target
d1c87259d8611552bfcad0b0de13a0d3778b55948d70786cdc818f2b4e1da612N
-
Size
391KB
-
MD5
d4fc2582d2215c1f86cfd80e0263bab0
-
SHA1
d877f78cb5461cbf4f4f2d30300f10d8174cee55
-
SHA256
d1c87259d8611552bfcad0b0de13a0d3778b55948d70786cdc818f2b4e1da612
-
SHA512
5a4937d5a2568da4ebbeaf0286130e3bab37584c9cd4112e81d3e64048b3170c09cebf0e57adf9f9d8c9fcccf9530a4bcff5486bc2c64d88e6f64ab145f0822f
-
SSDEEP
6144:Kty+bnr+jp0yN90QEcplgwSI8tYD1LjDXjqm7lA11Qh:PMrzy90QSI8G9j5eQh
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1