General

  • Target

    42af49b56210b0f788a1ade835c17968375dfb68cc558201592611e2c6aa50e4

  • Size

    660KB

  • Sample

    241109-fr8r3aybpp

  • MD5

    4c802a78a7d3c0776e7232223d97ad17

  • SHA1

    0bcbc5a921a6ec5944b9be8e6a7e018378d53bcd

  • SHA256

    42af49b56210b0f788a1ade835c17968375dfb68cc558201592611e2c6aa50e4

  • SHA512

    fe832b71de670210e1c143c6109f51dde24880282ec22be51b2dd9289d966f7b3648b5fb4815f374ab7b8ebb1363a2244e28c05339cf0b9fd5447b7981e1cb5c

  • SSDEEP

    12288:4MrIy90APFZkAUYzfVQSeOaWZjjBfiyyzSYzx2T1SzcL2fSEcGxo+REw:gyjPrdzfBZjjBqht2T1EbNcGx3

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Targets

    • Target

      42af49b56210b0f788a1ade835c17968375dfb68cc558201592611e2c6aa50e4

    • Size

      660KB

    • MD5

      4c802a78a7d3c0776e7232223d97ad17

    • SHA1

      0bcbc5a921a6ec5944b9be8e6a7e018378d53bcd

    • SHA256

      42af49b56210b0f788a1ade835c17968375dfb68cc558201592611e2c6aa50e4

    • SHA512

      fe832b71de670210e1c143c6109f51dde24880282ec22be51b2dd9289d966f7b3648b5fb4815f374ab7b8ebb1363a2244e28c05339cf0b9fd5447b7981e1cb5c

    • SSDEEP

      12288:4MrIy90APFZkAUYzfVQSeOaWZjjBfiyyzSYzx2T1SzcL2fSEcGxo+REw:gyjPrdzfBZjjBqht2T1EbNcGx3

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks