General

  • Target

    a056979717d8447d0a660173938754887945e0fdea792fdf89106c33712900d3

  • Size

    1.1MB

  • Sample

    241109-elyjgaxcqm

  • MD5

    a651787d099310a55be3389b9328de7e

  • SHA1

    711d849c3f8c4218fa652c398f5880c4fbe64532

  • SHA256

    a056979717d8447d0a660173938754887945e0fdea792fdf89106c33712900d3

  • SHA512

    4ec1ed5c8397a32e0a8dcf6a2f6f523e160c77195cee15db9d441701390e2d0a0ea4367a9164b368ffc60f30c068b0d8adb17ea91385d390cb64a2e6a8031b47

  • SSDEEP

    24576:py9eiPpAgXUMAj8bjAkT0pdgPP9G8vMlok35dE7nORKg9:c99hA4K8HsPgX9+o+5Se

Malware Config

Targets

    • Target

      a056979717d8447d0a660173938754887945e0fdea792fdf89106c33712900d3

    • Size

      1.1MB

    • MD5

      a651787d099310a55be3389b9328de7e

    • SHA1

      711d849c3f8c4218fa652c398f5880c4fbe64532

    • SHA256

      a056979717d8447d0a660173938754887945e0fdea792fdf89106c33712900d3

    • SHA512

      4ec1ed5c8397a32e0a8dcf6a2f6f523e160c77195cee15db9d441701390e2d0a0ea4367a9164b368ffc60f30c068b0d8adb17ea91385d390cb64a2e6a8031b47

    • SSDEEP

      24576:py9eiPpAgXUMAj8bjAkT0pdgPP9G8vMlok35dE7nORKg9:c99hA4K8HsPgX9+o+5Se

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks