General

  • Target

    4fa97f5d6ca58d29e11c8e565460c1cea15e392b7d3d2f3800103483af1d7342

  • Size

    531KB

  • Sample

    241109-enlyfswpey

  • MD5

    c57c4e8da4d9be3bcb3e4a8b082bfa83

  • SHA1

    2ed03afdcf5b940d1e7c7c66bb1cdb41969b15d7

  • SHA256

    4fa97f5d6ca58d29e11c8e565460c1cea15e392b7d3d2f3800103483af1d7342

  • SHA512

    51cd736ddffc16c0c48a2ccec4909f1db3d9d709001d56a3d7f0f1ba8b1a33d65897dccb1e1500ef40e53f2b01d8fdee184d3757b6954064da2cfe3fe97d4f54

  • SSDEEP

    12288:EMroy90C4Lhkt8E7rr8kWIL64i8xtEAOKdILOOAecLO/r:syRIhqTpjL6H6tTOIIy1or

Malware Config

Extracted

Family

redline

Botnet

rulit

C2

pedigj.eu:4162

Attributes
  • auth_value

    f4df9ef56871d4ac883b282abaf635e0

Targets

    • Target

      4fa97f5d6ca58d29e11c8e565460c1cea15e392b7d3d2f3800103483af1d7342

    • Size

      531KB

    • MD5

      c57c4e8da4d9be3bcb3e4a8b082bfa83

    • SHA1

      2ed03afdcf5b940d1e7c7c66bb1cdb41969b15d7

    • SHA256

      4fa97f5d6ca58d29e11c8e565460c1cea15e392b7d3d2f3800103483af1d7342

    • SHA512

      51cd736ddffc16c0c48a2ccec4909f1db3d9d709001d56a3d7f0f1ba8b1a33d65897dccb1e1500ef40e53f2b01d8fdee184d3757b6954064da2cfe3fe97d4f54

    • SSDEEP

      12288:EMroy90C4Lhkt8E7rr8kWIL64i8xtEAOKdILOOAecLO/r:syRIhqTpjL6H6tTOIIy1or

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks