Overview

overview

10

Static

static

3

aeded8d176...f7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    32596b1be411d542987047ca18132a9dbc287ba4680d26e475387989583a4914

  • Size

    427KB

  • Sample

    241107-nb43ya1fmq

  • MD5

    1f98330aba42e28e3b6ce7b2a198537f

  • SHA1

    c26cfb2d5b874718d367f1ace4d2fe766b540d7b

  • SHA256

    32596b1be411d542987047ca18132a9dbc287ba4680d26e475387989583a4914

  • SHA512

    6f33b8395d80d335358fb73be157fd486a86e42e0fd0eb3d09b6fb559174c34773c0c1d9a6ec7b0b326da800195d9f3b14623c0bae9c5934bbce87b9df79e94f

  • SSDEEP

    12288:dl+fm9+qJLFPxwKhjolHRPft2NiAP+gBnm+:z+fmsqdFPlhjolx3gi4P

Score
10/10
healerredlinefukiadiscoverydropperevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      aeded8d176aea6a89efdab3a97df131e6ab95e440f5b9150e8de33ffc26441f7.exe

    • Size

      478KB

    • MD5

      e68cb405dfb2ac2319bec791c676a008

    • SHA1

      949f83260b06133366d6263056cccc78485697ea

    • SHA256

      aeded8d176aea6a89efdab3a97df131e6ab95e440f5b9150e8de33ffc26441f7

    • SHA512

      ab683f01bcb1fea09444afb7f0c7f9dd20b55d8c9c1418bfe716024f97e49351a33c198c76513ab6d1a419adf95ad32aa1b45b7c1e939d91a1ae75c4a101e009

    • SSDEEP

      12288:/Mr3y90K1tPg4KUdJJJBrfyGUq27RQq4Zp0b8:syRbI4KUPRqGUq2N8v

    Score
    10/10
    healerredlinefukiadiscoverydropperevasioninfostealerpersistencetrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Healer family

      healer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks