Overview

overview

10

Static

static

3

63b33a57f9...cf.exe

windows7-x64

10

63b33a57f9...cf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b66fb905a3acf8487e0a87c3ccd45a96a9e1757bfb80c69ee7c7c27af4710d70

  • Size

    602KB

  • Sample

    241104-rn38ys1cpd

  • MD5

    a81e9954f8fe6c9f753ecaba38b9e1b2

  • SHA1

    106b178881c5b84e29ee0c522ba629a94674348a

  • SHA256

    b66fb905a3acf8487e0a87c3ccd45a96a9e1757bfb80c69ee7c7c27af4710d70

  • SHA512

    658c5605eeb03daebb0e91b80c1f58022f51a5fb262091d56f0c8bb95c5bb997d8950bd0a1c09d06d4e54580c8e06bd3cc07cf5fd512c02225157173e80a874d

  • SSDEEP

    12288:j/IeUusbV9vLPyydkF5H+tJPnHGpVj3wf0kOpZ8s:jQoG9Gyene3nH63wfmpZt

Score
10/10
healerredlinedezikdiscoverydropperevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

dezik

C2

193.56.146.220:4174

Attributes
  • auth_value

    d39f21dca8edc10800b036ab83f4d75e

Targets

    • Target

      63b33a57f98060b24be7007b3ef02a1a248db8c0adbf0ce9c9016b2c7e2de1cf.exe

    • Size

      723KB

    • MD5

      9f0558c26402917e96a9b47632718c97

    • SHA1

      0dff7c168f8b38667b10174854df177062681d1a

    • SHA256

      63b33a57f98060b24be7007b3ef02a1a248db8c0adbf0ce9c9016b2c7e2de1cf

    • SHA512

      2dbfda84b019135b156c85de74cfbe55d1e6eb5bf91c874472f8312fa437eeee0e88fbcb2a9d4cb97aba03e321a0894fbea92de238039d63154eb74eb270fc13

    • SSDEEP

      12288:bPHlKPGwVTTl9OHeVLZWsV5PRkKwLDxY8krRdq72FVxPwt6qQ6TjD:DlKPVTl9IeVdt9RkMdd9JwTn

    Score
    10/10
    healerredlinedezikdiscoverydropperevasioninfostealerpersistencetrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Healer family

      healer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks