General

  • Target

    e95f36a6ecf7da6823f51f80114ac30b788e7543590402a44c0b644656bca115

  • Size

    690KB

  • Sample

    241109-ehv9yazleq

  • MD5

    e695215c0ebc790cf5a07f9916eddc8a

  • SHA1

    f26fe799df966d262dfbdd3485060019d6a04100

  • SHA256

    e95f36a6ecf7da6823f51f80114ac30b788e7543590402a44c0b644656bca115

  • SHA512

    8b53083f0c1de61dfaa13f59fb3d8cf26bd38ebe558446b139cb3d446f2448f52f4c71e8ed206fb852af50740e4810156811f5bb8adfc4e9c1939c8f23975f39

  • SSDEEP

    12288:Ry90QdsSxw4BgFycS+KkCA7vJWmSCKw0/lY2ymJ94pH+:Ry9dsn4SPRCA7hWiqG2yAepH+

Malware Config

Targets

    • Target

      e95f36a6ecf7da6823f51f80114ac30b788e7543590402a44c0b644656bca115

    • Size

      690KB

    • MD5

      e695215c0ebc790cf5a07f9916eddc8a

    • SHA1

      f26fe799df966d262dfbdd3485060019d6a04100

    • SHA256

      e95f36a6ecf7da6823f51f80114ac30b788e7543590402a44c0b644656bca115

    • SHA512

      8b53083f0c1de61dfaa13f59fb3d8cf26bd38ebe558446b139cb3d446f2448f52f4c71e8ed206fb852af50740e4810156811f5bb8adfc4e9c1939c8f23975f39

    • SSDEEP

      12288:Ry90QdsSxw4BgFycS+KkCA7vJWmSCKw0/lY2ymJ94pH+:Ry9dsn4SPRCA7hWiqG2yAepH+

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks