General

  • Target

    95c4b018745aba2bc13f077c9e7ec6576929ab99ceeec34cec13ebfbafb21a4e

  • Size

    705KB

  • Sample

    241109-fjdxqayajf

  • MD5

    131060aa9828fd0c177486bd0f909291

  • SHA1

    3e7c5236d6768ef03314cb7c4a50088e1272231d

  • SHA256

    95c4b018745aba2bc13f077c9e7ec6576929ab99ceeec34cec13ebfbafb21a4e

  • SHA512

    615a6627361808ad189a2cba1827c5592b3f413ee686a06a270b83e1f224251c813305b8cde4177488a4ef1a4ac6f1f0c825d4ee3f935d63f5820b0422f86d33

  • SSDEEP

    12288:Xy90VpF/vqBgyw7YdtX0leLyHTnm1B70xX4w9US6lSH5S+GkA:Xycqfw7G0leLqTABYKwSS69FkA

Malware Config

Targets

    • Target

      95c4b018745aba2bc13f077c9e7ec6576929ab99ceeec34cec13ebfbafb21a4e

    • Size

      705KB

    • MD5

      131060aa9828fd0c177486bd0f909291

    • SHA1

      3e7c5236d6768ef03314cb7c4a50088e1272231d

    • SHA256

      95c4b018745aba2bc13f077c9e7ec6576929ab99ceeec34cec13ebfbafb21a4e

    • SHA512

      615a6627361808ad189a2cba1827c5592b3f413ee686a06a270b83e1f224251c813305b8cde4177488a4ef1a4ac6f1f0c825d4ee3f935d63f5820b0422f86d33

    • SSDEEP

      12288:Xy90VpF/vqBgyw7YdtX0leLyHTnm1B70xX4w9US6lSH5S+GkA:Xycqfw7G0leLqTABYKwSS69FkA

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks