Resubmissions

29-10-2024 12:23

241029-pkkakawpck 10

07-05-2023 00:50

230507-a684gseb32 10

General

  • Target

    32635fb3b78dfdd743f8397d234f64492de0513692c3c6c327c17530edda29c8.bin

  • Size

    1.2MB

  • Sample

    241029-pkkakawpck

  • MD5

    adeb3cf19fc631417662a75dfcf2333d

  • SHA1

    c2308d6e37057d7ed8257eccd9734327b7a37525

  • SHA256

    32635fb3b78dfdd743f8397d234f64492de0513692c3c6c327c17530edda29c8

  • SHA512

    a6c66a5ff87889797e73e2db03ea83688a9c7f0a7cf4e7239ae6ce8cf748c191a250bf558801e1b9e8ac3b49022464dfc82bf5891283b324e28f81db5445b7ee

  • SSDEEP

    24576:NcfsVIKzRLTr3vkFjAacR3lMERO6s0fYK++YSYuugo4cyC/:Nc+I8X8FjAacEER9NYK+lngo4cyC

Malware Config

Targets

    • Target

      32635fb3b78dfdd743f8397d234f64492de0513692c3c6c327c17530edda29c8.bin

    • Size

      1.2MB

    • MD5

      adeb3cf19fc631417662a75dfcf2333d

    • SHA1

      c2308d6e37057d7ed8257eccd9734327b7a37525

    • SHA256

      32635fb3b78dfdd743f8397d234f64492de0513692c3c6c327c17530edda29c8

    • SHA512

      a6c66a5ff87889797e73e2db03ea83688a9c7f0a7cf4e7239ae6ce8cf748c191a250bf558801e1b9e8ac3b49022464dfc82bf5891283b324e28f81db5445b7ee

    • SSDEEP

      24576:NcfsVIKzRLTr3vkFjAacR3lMERO6s0fYK++YSYuugo4cyC/:Nc+I8X8FjAacEER9NYK+lngo4cyC

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.