General

  • Target

    f72817279c78e2b0c2b7edc6a726621cc81794cfc04846f997f371d71ab025dd

  • Size

    534KB

  • Sample

    241109-gne61sygrh

  • MD5

    f01bfb5bbd0bd804c9ed479241332033

  • SHA1

    88fc6545c6420ec8209719a8611efbc6a268195a

  • SHA256

    f72817279c78e2b0c2b7edc6a726621cc81794cfc04846f997f371d71ab025dd

  • SHA512

    82d4b2e30f628307fd61dfa52394a2ee4c13839fbe9c6e63c5b9dcfa8685cc362d83554b4d3216600f4c2d4c66f50c3622430482fb496645446c8dce956996c0

  • SSDEEP

    12288:yMr4y90nbsCmcWH89nob3Ws9CDwvRAJt:Oye4CFWcW3f9CDw2Jt

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Targets

    • Target

      f72817279c78e2b0c2b7edc6a726621cc81794cfc04846f997f371d71ab025dd

    • Size

      534KB

    • MD5

      f01bfb5bbd0bd804c9ed479241332033

    • SHA1

      88fc6545c6420ec8209719a8611efbc6a268195a

    • SHA256

      f72817279c78e2b0c2b7edc6a726621cc81794cfc04846f997f371d71ab025dd

    • SHA512

      82d4b2e30f628307fd61dfa52394a2ee4c13839fbe9c6e63c5b9dcfa8685cc362d83554b4d3216600f4c2d4c66f50c3622430482fb496645446c8dce956996c0

    • SSDEEP

      12288:yMr4y90nbsCmcWH89nob3Ws9CDwvRAJt:Oye4CFWcW3f9CDw2Jt

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks