General

  • Target

    f0e949e8fbe63024a604dc638093601892c07419b02afb956c8f91f8a5bed6cf

  • Size

    546KB

  • Sample

    241109-ep4vnaxdnk

  • MD5

    638f1ac4ab40ac5addd2ea8c5f1b8dd9

  • SHA1

    8edc63c609de91d8665c140d04334ff44f4820be

  • SHA256

    f0e949e8fbe63024a604dc638093601892c07419b02afb956c8f91f8a5bed6cf

  • SHA512

    5e28f32e3490cf3983954aa1010acfc55eda8c155061567fa35657466947c828bda50624e52cafd6fb7dcba583b50cf9da5717c6d294bf30b3f91abe9509bbd6

  • SSDEEP

    12288:wMr9y90q057ZZxP/x08Wmxpk2gpzvpfGQAsrPlgRx/+T+HmLh:dyI7ZZxPvVXojp+Q9b8xDqh

Malware Config

Extracted

Family

redline

Botnet

rosto

C2

hueref.eu:4162

Attributes
  • auth_value

    07d81eba8cad42bbd0ae60042d48eac6

Targets

    • Target

      f0e949e8fbe63024a604dc638093601892c07419b02afb956c8f91f8a5bed6cf

    • Size

      546KB

    • MD5

      638f1ac4ab40ac5addd2ea8c5f1b8dd9

    • SHA1

      8edc63c609de91d8665c140d04334ff44f4820be

    • SHA256

      f0e949e8fbe63024a604dc638093601892c07419b02afb956c8f91f8a5bed6cf

    • SHA512

      5e28f32e3490cf3983954aa1010acfc55eda8c155061567fa35657466947c828bda50624e52cafd6fb7dcba583b50cf9da5717c6d294bf30b3f91abe9509bbd6

    • SSDEEP

      12288:wMr9y90q057ZZxP/x08Wmxpk2gpzvpfGQAsrPlgRx/+T+HmLh:dyI7ZZxPvVXojp+Q9b8xDqh

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks