General

  • Target

    20ff4fa5bece4f974842dd9afa8becffd48d85c6ef508c513f78ba4d8cc1c4dc

  • Size

    787KB

  • Sample

    241109-f3bxgaydla

  • MD5

    0b9ca325c6f44cfd5ae68f6f4857ea25

  • SHA1

    8b4f7ab3d32fba71545358246ff59bc234d3f482

  • SHA256

    20ff4fa5bece4f974842dd9afa8becffd48d85c6ef508c513f78ba4d8cc1c4dc

  • SHA512

    02e80ea5987e055663457771265b43f83dd2a90787ed01d9fa452bdf90035ca2e78b22b037995337f5f0c517ae4b7bd324481ab464a84912425965b31464bdff

  • SSDEEP

    12288:TMrIy90LNcRDEqTe7ibKRQcFzWDPp3yRMjnFt8qql2dm0Xm04c5hH/3:vy6coZWcFyrp3yAFamm0XX4sR/3

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Targets

    • Target

      20ff4fa5bece4f974842dd9afa8becffd48d85c6ef508c513f78ba4d8cc1c4dc

    • Size

      787KB

    • MD5

      0b9ca325c6f44cfd5ae68f6f4857ea25

    • SHA1

      8b4f7ab3d32fba71545358246ff59bc234d3f482

    • SHA256

      20ff4fa5bece4f974842dd9afa8becffd48d85c6ef508c513f78ba4d8cc1c4dc

    • SHA512

      02e80ea5987e055663457771265b43f83dd2a90787ed01d9fa452bdf90035ca2e78b22b037995337f5f0c517ae4b7bd324481ab464a84912425965b31464bdff

    • SSDEEP

      12288:TMrIy90LNcRDEqTe7ibKRQcFzWDPp3yRMjnFt8qql2dm0Xm04c5hH/3:vy6coZWcFyrp3yAFamm0XX4sR/3

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks