General

  • Target

    2a6038b8add89590fd7cbed1406b1c271ceaf303829b1861cc87e4b14d072ac6

  • Size

    989KB

  • Sample

    241109-d7bq6awhpa

  • MD5

    20f5f4b591f7bb1c7f7536be535ad9e0

  • SHA1

    b062eaa0b5bbdc523db92099b76ff3997ec7ed06

  • SHA256

    2a6038b8add89590fd7cbed1406b1c271ceaf303829b1861cc87e4b14d072ac6

  • SHA512

    3905fd989abecf2dc24abf8af6e4fecb347575117fc7240dba2347d03d604f663b14a9ed4e4ba40398e3678c141f5bc79719384f1f3fb18f599d947bf4abb485

  • SSDEEP

    12288:xMrqy90oMarJ4YqWBpnBy3ds0rLHFatIo7gIgPWNaIAK3X/UUVfDfKz9HUBc:7y59bzByNs0rctL7g0oKnHu90Bc

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Targets

    • Target

      2a6038b8add89590fd7cbed1406b1c271ceaf303829b1861cc87e4b14d072ac6

    • Size

      989KB

    • MD5

      20f5f4b591f7bb1c7f7536be535ad9e0

    • SHA1

      b062eaa0b5bbdc523db92099b76ff3997ec7ed06

    • SHA256

      2a6038b8add89590fd7cbed1406b1c271ceaf303829b1861cc87e4b14d072ac6

    • SHA512

      3905fd989abecf2dc24abf8af6e4fecb347575117fc7240dba2347d03d604f663b14a9ed4e4ba40398e3678c141f5bc79719384f1f3fb18f599d947bf4abb485

    • SSDEEP

      12288:xMrqy90oMarJ4YqWBpnBy3ds0rLHFatIo7gIgPWNaIAK3X/UUVfDfKz9HUBc:7y59bzByNs0rctL7g0oKnHu90Bc

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks