Overview

overview

10

Static

static

3

754c8228a8...2e.exe

windows7-x64

10

754c8228a8...2e.exe

windows10-2004-x64

10

754c8228a8...2e.exe

windows10-ltsc 2021-x64

10

754c8228a8...2e.exe

windows11-21h2-x64

10

Resubmissions

28-10-2024 23:03

241028-2127jaxkgr 10

21-03-2023 01:55

230321-ccfk7agd36 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    754c8228a8f90fa5aad24c1af9b6061b6763a4f274f86f8c420dfb380c613f2e

  • Size

    779KB

  • Sample

    241028-2127jaxkgr

  • MD5

    6c7b6f945d9c685bab02bd41eb30d868

  • SHA1

    0aa978cc4e9592040db95c7a34a241c31da51018

  • SHA256

    754c8228a8f90fa5aad24c1af9b6061b6763a4f274f86f8c420dfb380c613f2e

  • SHA512

    12da401b4fa468695905e10be71fd3cc12e7c3b0e2e912dbaddc46b968123468419c4e5fb5b65dbc4766bc9b3e62d8b00583dfdca4df6f583931302cb7a8254e

  • SSDEEP

    12288:8Mrdy90k4QqkMnF4T+hYYLgzge+f6FMsTlf8Q5TWiClpcUhvHhz:Byn45vSTmlLghyKMsTlfDRWflJvHl

Score
10/10
healerredlinegenadiscoverydropperevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

gena

C2

193.233.20.30:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Targets

    • Target

      754c8228a8f90fa5aad24c1af9b6061b6763a4f274f86f8c420dfb380c613f2e

    • Size

      779KB

    • MD5

      6c7b6f945d9c685bab02bd41eb30d868

    • SHA1

      0aa978cc4e9592040db95c7a34a241c31da51018

    • SHA256

      754c8228a8f90fa5aad24c1af9b6061b6763a4f274f86f8c420dfb380c613f2e

    • SHA512

      12da401b4fa468695905e10be71fd3cc12e7c3b0e2e912dbaddc46b968123468419c4e5fb5b65dbc4766bc9b3e62d8b00583dfdca4df6f583931302cb7a8254e

    • SSDEEP

      12288:8Mrdy90k4QqkMnF4T+hYYLgzge+f6FMsTlf8Q5TWiClpcUhvHhz:Byn45vSTmlLghyKMsTlfDRWflJvHl

    Score
    10/10
    healerredlinegenadiscoverydropperevasioninfostealerpersistencetrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Healer family

      healer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks