General

  • Target

    c8bb74f93b4ab991ca87a9fa2f2359637c81aaadde934ec0d051f3d1b4584ced

  • Size

    660KB

  • Sample

    241105-fpyjbaxpbq

  • MD5

    ec27b7e9b50ef0c84d4f5db35bfc27c5

  • SHA1

    768ac62dc45e6f192eb3779c512c1931ee6c78f1

  • SHA256

    c8bb74f93b4ab991ca87a9fa2f2359637c81aaadde934ec0d051f3d1b4584ced

  • SHA512

    592697f14b49f7e562b9d1defa9079baac13ba5bf0ea9d57bab8c900c002c492368903c8050c5bfc0acf69306d33534f93bd191a8c8c418e6cf9e0efcfd9c2de

  • SSDEEP

    12288:7MrYy90tpvjrEwd5BNrQS+s6ZSkaVscDpRIUbbpzhpLpSLkthAkwhzJw38:HyCxjZd5l+s6ZSkOpbbn9Ushgh+38

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

dozt

C2

77.91.124.145:4125

Attributes
  • auth_value

    857bdfe4fa14711025859d89f18b32cb

Targets

    • Target

      c8bb74f93b4ab991ca87a9fa2f2359637c81aaadde934ec0d051f3d1b4584ced

    • Size

      660KB

    • MD5

      ec27b7e9b50ef0c84d4f5db35bfc27c5

    • SHA1

      768ac62dc45e6f192eb3779c512c1931ee6c78f1

    • SHA256

      c8bb74f93b4ab991ca87a9fa2f2359637c81aaadde934ec0d051f3d1b4584ced

    • SHA512

      592697f14b49f7e562b9d1defa9079baac13ba5bf0ea9d57bab8c900c002c492368903c8050c5bfc0acf69306d33534f93bd191a8c8c418e6cf9e0efcfd9c2de

    • SSDEEP

      12288:7MrYy90tpvjrEwd5BNrQS+s6ZSkaVscDpRIUbbpzhpLpSLkthAkwhzJw38:HyCxjZd5l+s6ZSkOpbbn9Ushgh+38

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks