General

  • Target

    febd565f048c4a4eaf703eb999c7da44ebf74c7bf3d80579b55aacaf9d576f83

  • Size

    660KB

  • Sample

    241105-l1ferszdqm

  • MD5

    20ddac947e44ce60ca9ab1fc6c27eb65

  • SHA1

    b526fedad6c25a4887b1500cfa16e7019177a696

  • SHA256

    febd565f048c4a4eaf703eb999c7da44ebf74c7bf3d80579b55aacaf9d576f83

  • SHA512

    2ea6fb487a9bcd04f0bb9fe45b6cd759c9de134ca139f7ded1ccc6d77ed368c94f024b2c9e8dd8db2b46981b34bc33d1be10d442385ec197b8ed31592e725cb7

  • SSDEEP

    12288:gMray90bOl2gyIouTVKaAcUbAM4gluhzExYYFYtQkarY:qyo82luTVV7tMfEExYKjka8

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

dozt

C2

77.91.124.145:4125

Attributes
  • auth_value

    857bdfe4fa14711025859d89f18b32cb

Targets

    • Target

      febd565f048c4a4eaf703eb999c7da44ebf74c7bf3d80579b55aacaf9d576f83

    • Size

      660KB

    • MD5

      20ddac947e44ce60ca9ab1fc6c27eb65

    • SHA1

      b526fedad6c25a4887b1500cfa16e7019177a696

    • SHA256

      febd565f048c4a4eaf703eb999c7da44ebf74c7bf3d80579b55aacaf9d576f83

    • SHA512

      2ea6fb487a9bcd04f0bb9fe45b6cd759c9de134ca139f7ded1ccc6d77ed368c94f024b2c9e8dd8db2b46981b34bc33d1be10d442385ec197b8ed31592e725cb7

    • SSDEEP

      12288:gMray90bOl2gyIouTVKaAcUbAM4gluhzExYYFYtQkarY:qyo82luTVV7tMfEExYKjka8

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks