General

  • Target

    4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675

  • Size

    389KB

  • Sample

    230720-gc7rwsde3t

  • MD5

    073f84f40946716ae47ea59af7fc3979

  • SHA1

    f39ce1dd5b30a263986c6831bc7bf4b662b3ce5c

  • SHA256

    4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675

  • SHA512

    7a9758b20b794cac8a5a9e8dae5fb55f6cfb5b69e8ab5ab804088e67975436826746e5fe18473f56e4544bf148c35dc1a1029768bf3262e58372afbc7d9ca93a

  • SSDEEP

    6144:KGy+bnr+xp0yN90QESFxnVkONlvhYZbG7qMh+hn0E3+YIu5ly4RChw/:yMrFy90wSONcbG75w3+YNly2Chw/

Malware Config

Extracted

Family

redline

Botnet

nasa

C2

77.91.68.68:19071

Attributes
  • auth_value

    6da71218d8a9738ea3a9a78b5677589b

Targets

    • Target

      4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675

    • Size

      389KB

    • MD5

      073f84f40946716ae47ea59af7fc3979

    • SHA1

      f39ce1dd5b30a263986c6831bc7bf4b662b3ce5c

    • SHA256

      4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675

    • SHA512

      7a9758b20b794cac8a5a9e8dae5fb55f6cfb5b69e8ab5ab804088e67975436826746e5fe18473f56e4544bf148c35dc1a1029768bf3262e58372afbc7d9ca93a

    • SSDEEP

      6144:KGy+bnr+xp0yN90QESFxnVkONlvhYZbG7qMh+hn0E3+YIu5ly4RChw/:yMrFy90wSONcbG75w3+YNly2Chw/

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks