General

  • Target

    8cb03552634bbcf3fcc1d711ce0be55ad01f2ec51390dfd1f28cebbdfd7769cf

  • Size

    482KB

  • Sample

    241106-p7qqvszkgz

  • MD5

    f5d823c06ae58b5767d78f8a57497bc9

  • SHA1

    32ab96d9ea954bc26d3466346944711482cda1c5

  • SHA256

    8cb03552634bbcf3fcc1d711ce0be55ad01f2ec51390dfd1f28cebbdfd7769cf

  • SHA512

    3fd38edd872b5a6dbf9e38b2a0139b0f370d12fd1b41d9a7ad5837bf053012b1d45261ed4f338da489837c1bd4d19759505274c8949cd6c800b8e72d76312b4f

  • SSDEEP

    12288:uMrUy90DfIxOeVqbHt1jkMi80YbfO2fKyhM:+yCgseVSHt1jkC5PhM

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      8cb03552634bbcf3fcc1d711ce0be55ad01f2ec51390dfd1f28cebbdfd7769cf

    • Size

      482KB

    • MD5

      f5d823c06ae58b5767d78f8a57497bc9

    • SHA1

      32ab96d9ea954bc26d3466346944711482cda1c5

    • SHA256

      8cb03552634bbcf3fcc1d711ce0be55ad01f2ec51390dfd1f28cebbdfd7769cf

    • SHA512

      3fd38edd872b5a6dbf9e38b2a0139b0f370d12fd1b41d9a7ad5837bf053012b1d45261ed4f338da489837c1bd4d19759505274c8949cd6c800b8e72d76312b4f

    • SSDEEP

      12288:uMrUy90DfIxOeVqbHt1jkMi80YbfO2fKyhM:+yCgseVSHt1jkC5PhM

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks