General

  • Target

    11fcd8b8b4e5fb12efc7e58ba089826ee1f266c2d76ee79e747f258a0a52acac

  • Size

    962KB

  • Sample

    241106-xwq69awcnd

  • MD5

    232f11c4f689362aedb6dd6ee7572c2c

  • SHA1

    68a9a366707324ad3b3918b4b8479a9e53937d0b

  • SHA256

    11fcd8b8b4e5fb12efc7e58ba089826ee1f266c2d76ee79e747f258a0a52acac

  • SHA512

    f17a3e4c0b996c2c4353407939afdd77a2c62e8cfc4292781c13aa60b06f8475291ffdc51e81ea5918f51a86be5ee0bce55b4ab5fa3ef07895fbd1c1326556e5

  • SSDEEP

    24576:2yvD0BMTUDLHLQJEjRU0uWmiyikyKpWEaRw:FvgGTeIEjWWbQ4

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

diro

C2

185.161.248.90:4125

Attributes
  • auth_value

    ae95bda0dd2e95169886a3a68138568b

Targets

    • Target

      11fcd8b8b4e5fb12efc7e58ba089826ee1f266c2d76ee79e747f258a0a52acac

    • Size

      962KB

    • MD5

      232f11c4f689362aedb6dd6ee7572c2c

    • SHA1

      68a9a366707324ad3b3918b4b8479a9e53937d0b

    • SHA256

      11fcd8b8b4e5fb12efc7e58ba089826ee1f266c2d76ee79e747f258a0a52acac

    • SHA512

      f17a3e4c0b996c2c4353407939afdd77a2c62e8cfc4292781c13aa60b06f8475291ffdc51e81ea5918f51a86be5ee0bce55b4ab5fa3ef07895fbd1c1326556e5

    • SSDEEP

      24576:2yvD0BMTUDLHLQJEjRU0uWmiyikyKpWEaRw:FvgGTeIEjWWbQ4

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks