General

  • Target

    e7adf79462312919c867a235c8d6ba900b2606e935426609cf2a8979644182fd

  • Size

    1.1MB

  • Sample

    241109-d82zqsxalj

  • MD5

    8005dfad6a25bd523da30a4d2ecea1cd

  • SHA1

    e70e11cdbbb9fdf3071599b48f7e7dbcb10a338a

  • SHA256

    e7adf79462312919c867a235c8d6ba900b2606e935426609cf2a8979644182fd

  • SHA512

    c7af49ead6ff8ee4b8b7086a76b16345dd9be193421065de2d75f671dcaafd724ca4fd8d19ea79749ecf2145fda6720e2771ae15780300f4083aae75c95e35d3

  • SSDEEP

    24576:cyyXU1T7TZKbM5Hyckx8PtD5sX7kydsb6tOIjlsrDeZ:LuU1T7dYM5HQx8PtFsX7kydwYOIx

Malware Config

Targets

    • Target

      e7adf79462312919c867a235c8d6ba900b2606e935426609cf2a8979644182fd

    • Size

      1.1MB

    • MD5

      8005dfad6a25bd523da30a4d2ecea1cd

    • SHA1

      e70e11cdbbb9fdf3071599b48f7e7dbcb10a338a

    • SHA256

      e7adf79462312919c867a235c8d6ba900b2606e935426609cf2a8979644182fd

    • SHA512

      c7af49ead6ff8ee4b8b7086a76b16345dd9be193421065de2d75f671dcaafd724ca4fd8d19ea79749ecf2145fda6720e2771ae15780300f4083aae75c95e35d3

    • SSDEEP

      24576:cyyXU1T7TZKbM5Hyckx8PtD5sX7kydsb6tOIjlsrDeZ:LuU1T7dYM5HQx8PtFsX7kydwYOIx

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks