General

  • Target

    38e60099abbc39569dcf160f63854be6270a2e9f629be79aa1066181696467c7

  • Size

    480KB

  • Sample

    241104-zlhs8sxekj

  • MD5

    e4ccbf6c8ed6c6811fbf0bf8d6fbd1c3

  • SHA1

    7e7cc5ced06d79cedd7e63312d7da128ec3965a3

  • SHA256

    38e60099abbc39569dcf160f63854be6270a2e9f629be79aa1066181696467c7

  • SHA512

    88c6bbfe8b722f994dc71e1d5a750bf38e75c216cd77c2bf01f6849d2570a20de94599161a78cc20363f4eb83ac9ea57f7b0914fbe1609564ed1827e1cc94cef

  • SSDEEP

    12288:fMrxy900fNpFpWmjmZ+eQksCOoJECdVdOh:Cyffq3+EPduh

Malware Config

Extracted

Family

redline

Botnet

mofun

C2

217.196.96.101:4132

Attributes
  • auth_value

    da5d4987d25c2de43d34fcc99b29fff3

Targets

    • Target

      38e60099abbc39569dcf160f63854be6270a2e9f629be79aa1066181696467c7

    • Size

      480KB

    • MD5

      e4ccbf6c8ed6c6811fbf0bf8d6fbd1c3

    • SHA1

      7e7cc5ced06d79cedd7e63312d7da128ec3965a3

    • SHA256

      38e60099abbc39569dcf160f63854be6270a2e9f629be79aa1066181696467c7

    • SHA512

      88c6bbfe8b722f994dc71e1d5a750bf38e75c216cd77c2bf01f6849d2570a20de94599161a78cc20363f4eb83ac9ea57f7b0914fbe1609564ed1827e1cc94cef

    • SSDEEP

      12288:fMrxy900fNpFpWmjmZ+eQksCOoJECdVdOh:Cyffq3+EPduh

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks