General

  • Target

    f65e5c121d736dc6c063af3d8de2d394e4f978a5aa980aa545e3a35d7bd2e49a

  • Size

    964KB

  • Sample

    241106-1pw1psxpey

  • MD5

    4bd6ca52c9a8686a653a13b55e751c90

  • SHA1

    e090edb5d92bd76ea0ea71998f00a45c8a8c08cc

  • SHA256

    f65e5c121d736dc6c063af3d8de2d394e4f978a5aa980aa545e3a35d7bd2e49a

  • SHA512

    c58d57091e43d6a45373418f0d5586308a96e2d2c07a33c7ecc0d6560e0c9770a741c5607c73bdf67dffaaaa88eb263f78c7282545df4e45415a65cc9310f709

  • SSDEEP

    24576:vyp2/UlkJNaS8jSOI/NITnQWSDxJttubcDVxvbcNJia8VamvC+vRwc:6g/W5SeSOUNLPHtcbcJ5bcNisiw

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

disa

C2

185.161.248.90:4125

Attributes
  • auth_value

    93f8c4ca7000e3381dd4b6b86434de05

Targets

    • Target

      f65e5c121d736dc6c063af3d8de2d394e4f978a5aa980aa545e3a35d7bd2e49a

    • Size

      964KB

    • MD5

      4bd6ca52c9a8686a653a13b55e751c90

    • SHA1

      e090edb5d92bd76ea0ea71998f00a45c8a8c08cc

    • SHA256

      f65e5c121d736dc6c063af3d8de2d394e4f978a5aa980aa545e3a35d7bd2e49a

    • SHA512

      c58d57091e43d6a45373418f0d5586308a96e2d2c07a33c7ecc0d6560e0c9770a741c5607c73bdf67dffaaaa88eb263f78c7282545df4e45415a65cc9310f709

    • SSDEEP

      24576:vyp2/UlkJNaS8jSOI/NITnQWSDxJttubcDVxvbcNJia8VamvC+vRwc:6g/W5SeSOUNLPHtcbcJ5bcNisiw

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks