General

  • Target

    68d6e09074432c636b1b232a461bfa46cd9517c27730339d4ed26db71e61aa40

  • Size

    480KB

  • Sample

    241109-edxxzawmez

  • MD5

    3dbe7b5671fe69b282ef9d9cce5eef68

  • SHA1

    f0bf24e38c15245b1f544bfce667da751bbd7f40

  • SHA256

    68d6e09074432c636b1b232a461bfa46cd9517c27730339d4ed26db71e61aa40

  • SHA512

    792cb2193d646834135af5244119e6c707ce366f2f9a1184903cb608803c164895398b0d264872c1e22e5f31b05dfa70de20e1147e9714cc3216099211381241

  • SSDEEP

    12288:CMrXy9020GY5KCvgGU+FzgMh13yGmB3Xrr1zA:dyFYc0tU2H5upr2

Malware Config

Extracted

Family

redline

Botnet

mihan

C2

217.196.96.101:4132

Attributes
  • auth_value

    9a6a8fdae02ed7caa0a49a6ddc6d4520

Targets

    • Target

      68d6e09074432c636b1b232a461bfa46cd9517c27730339d4ed26db71e61aa40

    • Size

      480KB

    • MD5

      3dbe7b5671fe69b282ef9d9cce5eef68

    • SHA1

      f0bf24e38c15245b1f544bfce667da751bbd7f40

    • SHA256

      68d6e09074432c636b1b232a461bfa46cd9517c27730339d4ed26db71e61aa40

    • SHA512

      792cb2193d646834135af5244119e6c707ce366f2f9a1184903cb608803c164895398b0d264872c1e22e5f31b05dfa70de20e1147e9714cc3216099211381241

    • SSDEEP

      12288:CMrXy9020GY5KCvgGU+FzgMh13yGmB3Xrr1zA:dyFYc0tU2H5upr2

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks