General

  • Target

    0c423daf50ac1d1fb18455637a8b1189aa8527cb9fcecca2afe24d69234bcd34

  • Size

    577KB

  • Sample

    241109-edtwbaxarg

  • MD5

    8f856af40106052a7932d73c444accc7

  • SHA1

    c77233fff2ed7df7703ab79b83e8988caa41b49f

  • SHA256

    0c423daf50ac1d1fb18455637a8b1189aa8527cb9fcecca2afe24d69234bcd34

  • SHA512

    ae9a0544cc6692d3422b9da3b9b101ceec066b4efa112fc58a513e8bafe948091436038466272fad4b1983ba4aff67a1b85cc26e7d5d244d45fbc706cf1847b6

  • SSDEEP

    12288:4Mriy90Sahimz7AuxqVtc0kyjYtPkxhGneUpuI1fAWd4X:ayjsVAuxYyustPkSeUMIxAR

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Targets

    • Target

      0c423daf50ac1d1fb18455637a8b1189aa8527cb9fcecca2afe24d69234bcd34

    • Size

      577KB

    • MD5

      8f856af40106052a7932d73c444accc7

    • SHA1

      c77233fff2ed7df7703ab79b83e8988caa41b49f

    • SHA256

      0c423daf50ac1d1fb18455637a8b1189aa8527cb9fcecca2afe24d69234bcd34

    • SHA512

      ae9a0544cc6692d3422b9da3b9b101ceec066b4efa112fc58a513e8bafe948091436038466272fad4b1983ba4aff67a1b85cc26e7d5d244d45fbc706cf1847b6

    • SSDEEP

      12288:4Mriy90Sahimz7AuxqVtc0kyjYtPkxhGneUpuI1fAWd4X:ayjsVAuxYyustPkSeUMIxAR

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks