General

  • Target

    6fb65b8165cdb5a18a670648fc4b670f3701a03d20922a75087970117d97c597

  • Size

    690KB

  • Sample

    241104-qwlhfazlby

  • MD5

    fed201a22556bf78aea0f5cfd2bc7ec4

  • SHA1

    611dfa394bd20c1356c8bab37c4fceb988d7c395

  • SHA256

    6fb65b8165cdb5a18a670648fc4b670f3701a03d20922a75087970117d97c597

  • SHA512

    75aa2346fd1e8a9ed2c015fd91ca34ae006c422da18b24a2fadbb98707d1acd8ee02eb6939eeefe9070089633ef46abfab9c25d50578a26f2bbc3066f7a7fb53

  • SSDEEP

    12288:Ay909kgt7wUAXz+xXT9TDeuArNXMQfnCsGeniNxmBqEEFRhl4i:Ay2kgtrQWnRc1M9N1fD6i

Malware Config

Targets

    • Target

      6fb65b8165cdb5a18a670648fc4b670f3701a03d20922a75087970117d97c597

    • Size

      690KB

    • MD5

      fed201a22556bf78aea0f5cfd2bc7ec4

    • SHA1

      611dfa394bd20c1356c8bab37c4fceb988d7c395

    • SHA256

      6fb65b8165cdb5a18a670648fc4b670f3701a03d20922a75087970117d97c597

    • SHA512

      75aa2346fd1e8a9ed2c015fd91ca34ae006c422da18b24a2fadbb98707d1acd8ee02eb6939eeefe9070089633ef46abfab9c25d50578a26f2bbc3066f7a7fb53

    • SSDEEP

      12288:Ay909kgt7wUAXz+xXT9TDeuArNXMQfnCsGeniNxmBqEEFRhl4i:Ay2kgtrQWnRc1M9N1fD6i

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks