General

  • Target

    2c59ec6bddd3f457e1d57b21cc6551fe016a155fd7abfdee8487690253ab02a9

  • Size

    1.2MB

  • Sample

    241107-nk13ms1fme

  • MD5

    eb3b2dbf70f925c03d7f3b5e65506f63

  • SHA1

    18ece9a8cfd33c243f704ab7690aecf8765781b7

  • SHA256

    2c59ec6bddd3f457e1d57b21cc6551fe016a155fd7abfdee8487690253ab02a9

  • SHA512

    38748abfaf32da8bd3dd24b2d94827a2344acf61a730f5f4e1c61819a76a993eac8a7385c7c19c368406921f6a5dd30bcaaf609eb67a9bd026467a450ac1bb9f

  • SSDEEP

    24576:JyoPt2SMG6SjMjIKv1M9NsQyET498uU1Kous8X:8oIk6AMjIKv1IyQyEU98uU1

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

disa

C2

185.161.248.90:4125

Attributes
  • auth_value

    93f8c4ca7000e3381dd4b6b86434de05

Targets

    • Target

      2c59ec6bddd3f457e1d57b21cc6551fe016a155fd7abfdee8487690253ab02a9

    • Size

      1.2MB

    • MD5

      eb3b2dbf70f925c03d7f3b5e65506f63

    • SHA1

      18ece9a8cfd33c243f704ab7690aecf8765781b7

    • SHA256

      2c59ec6bddd3f457e1d57b21cc6551fe016a155fd7abfdee8487690253ab02a9

    • SHA512

      38748abfaf32da8bd3dd24b2d94827a2344acf61a730f5f4e1c61819a76a993eac8a7385c7c19c368406921f6a5dd30bcaaf609eb67a9bd026467a450ac1bb9f

    • SSDEEP

      24576:JyoPt2SMG6SjMjIKv1M9NsQyET498uU1Kous8X:8oIk6AMjIKv1IyQyEU98uU1

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks