General

  • Target

    95ecfc19962afc152ba14fbd662c1564e6050e44dc673a1791d11697c9ab8048

  • Size

    537KB

  • Sample

    241105-2hq2jsspdq

  • MD5

    880bd6a0e961c176c890113fe98a3107

  • SHA1

    e844ca6be56c8947d1f35e63ae62533fbc0f62cc

  • SHA256

    95ecfc19962afc152ba14fbd662c1564e6050e44dc673a1791d11697c9ab8048

  • SHA512

    d857e33d0ba2b1c7acb0870a73c58875002a95c003143f74b2bcca053e31ed61e92919cfe8202979d8cc60e483ef87dbc4acff458613b8efd51dc3e52bbeec90

  • SSDEEP

    12288:4MrOy90zp1aFfgs1wh3xJ/UHnHcwbm5ePofr5:2yRdgs1whBJ/48wbmIP45

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Targets

    • Target

      95ecfc19962afc152ba14fbd662c1564e6050e44dc673a1791d11697c9ab8048

    • Size

      537KB

    • MD5

      880bd6a0e961c176c890113fe98a3107

    • SHA1

      e844ca6be56c8947d1f35e63ae62533fbc0f62cc

    • SHA256

      95ecfc19962afc152ba14fbd662c1564e6050e44dc673a1791d11697c9ab8048

    • SHA512

      d857e33d0ba2b1c7acb0870a73c58875002a95c003143f74b2bcca053e31ed61e92919cfe8202979d8cc60e483ef87dbc4acff458613b8efd51dc3e52bbeec90

    • SSDEEP

      12288:4MrOy90zp1aFfgs1wh3xJ/UHnHcwbm5ePofr5:2yRdgs1whBJ/48wbmIP45

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks