General

  • Target

    145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596

  • Size

    480KB

  • Sample

    241104-qvfkss1bqm

  • MD5

    c76a91e79acd3aafe356cd158cdfd732

  • SHA1

    a1f38f01a288477ec2a0145543859db85f04ada7

  • SHA256

    145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596

  • SHA512

    cee2750c95404925c366c4fc7766a2175cdd989a6dc5b0e8a7ce7f554c15b73bc19392affe966d5e0aa705b9107f294ac6e0d5412c399503324e6ed417af81e3

  • SSDEEP

    12288:qMr0y90EcGV78L5erurlPcpDIfz1EUEKOoj9Xvt:KyulS8tcpKZmov

Malware Config

Targets

    • Target

      145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596

    • Size

      480KB

    • MD5

      c76a91e79acd3aafe356cd158cdfd732

    • SHA1

      a1f38f01a288477ec2a0145543859db85f04ada7

    • SHA256

      145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596

    • SHA512

      cee2750c95404925c366c4fc7766a2175cdd989a6dc5b0e8a7ce7f554c15b73bc19392affe966d5e0aa705b9107f294ac6e0d5412c399503324e6ed417af81e3

    • SSDEEP

      12288:qMr0y90EcGV78L5erurlPcpDIfz1EUEKOoj9Xvt:KyulS8tcpKZmov

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks