General

  • Target

    8cf9ccd6da36205ee83da0b0a5e7f6cc91d5bf077df572fab6e7109ae76cd4d9

  • Size

    478KB

  • Sample

    240510-ad176sfa4w

  • MD5

    56cbda6826023f3af9c6781e81eb5eb2

  • SHA1

    da2db737b6856bd7495fd7f4965f1ad7c1608c35

  • SHA256

    8cf9ccd6da36205ee83da0b0a5e7f6cc91d5bf077df572fab6e7109ae76cd4d9

  • SHA512

    98230f7393443acef809e5696e74cd194dd63cfbbb5d7cb3b8751d19d0ddc991299da2809cc4462249cc4b3c1ef578b6be44e5b79a87ae6dd8bb4b26bd571316

  • SSDEEP

    12288:CMrmy905CjTVLGuS5c1u31pTHoaPH+yvN5GOMU:gyB5Lj2XTTI8+iNUy

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      8cf9ccd6da36205ee83da0b0a5e7f6cc91d5bf077df572fab6e7109ae76cd4d9

    • Size

      478KB

    • MD5

      56cbda6826023f3af9c6781e81eb5eb2

    • SHA1

      da2db737b6856bd7495fd7f4965f1ad7c1608c35

    • SHA256

      8cf9ccd6da36205ee83da0b0a5e7f6cc91d5bf077df572fab6e7109ae76cd4d9

    • SHA512

      98230f7393443acef809e5696e74cd194dd63cfbbb5d7cb3b8751d19d0ddc991299da2809cc4462249cc4b3c1ef578b6be44e5b79a87ae6dd8bb4b26bd571316

    • SSDEEP

      12288:CMrmy905CjTVLGuS5c1u31pTHoaPH+yvN5GOMU:gyB5Lj2XTTI8+iNUy

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

    • Detects executables packed with ConfuserEx Mod

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks