General

  • Target

    bffcf8a3e45030ed55b49f6b04bb6e7fc2af147074717889c0849c8289f5e968

  • Size

    1.0MB

  • Sample

    241109-fj9z6ayalc

  • MD5

    bc1361c44492e9cacc03f230effe9bbf

  • SHA1

    df7119d39d212add843510d207028bf0e7a1d7f5

  • SHA256

    bffcf8a3e45030ed55b49f6b04bb6e7fc2af147074717889c0849c8289f5e968

  • SHA512

    0ccfff79f1461228864780a2323b2bed0025e568fdb1157721f384dc2676c08c5b3bed5182bf89e8b18d0dfa52dd57dd42fba511ec53c3e92d71c8e8eb5790b4

  • SSDEEP

    24576:xykl6dZAgdEWc1uesQfLE9OXSmqtJGMMl1FL:kklbZO2TEkClLGbF

Malware Config

Targets

    • Target

      bffcf8a3e45030ed55b49f6b04bb6e7fc2af147074717889c0849c8289f5e968

    • Size

      1.0MB

    • MD5

      bc1361c44492e9cacc03f230effe9bbf

    • SHA1

      df7119d39d212add843510d207028bf0e7a1d7f5

    • SHA256

      bffcf8a3e45030ed55b49f6b04bb6e7fc2af147074717889c0849c8289f5e968

    • SHA512

      0ccfff79f1461228864780a2323b2bed0025e568fdb1157721f384dc2676c08c5b3bed5182bf89e8b18d0dfa52dd57dd42fba511ec53c3e92d71c8e8eb5790b4

    • SSDEEP

      24576:xykl6dZAgdEWc1uesQfLE9OXSmqtJGMMl1FL:kklbZO2TEkClLGbF

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks