General

  • Target

    ee9ebccfe27092cd9602310dd613b493ae72cd25d7b91d48187583578334a2f5

  • Size

    701KB

  • Sample

    241109-gs192ssjfk

  • MD5

    2b4644251bb0cb94c0d07a9199e3c32d

  • SHA1

    48ec72482453a696ffc8c5f49f2d6f9f460754f7

  • SHA256

    ee9ebccfe27092cd9602310dd613b493ae72cd25d7b91d48187583578334a2f5

  • SHA512

    bf630a0df47224976fb1932eb400b7aa51da252736f7c44c381966297b0b40e19d2d743688165323798e6e845c707ed736694058efd89c2434cd96b80a69f99d

  • SSDEEP

    12288:Iy90nZ+7eLVXmi+dlPXvf2k4lgG92nEG28o9w2Whl/3prBiWCJDm:IyiaDPvmZGqwHDRrBiHJq

Malware Config

Targets

    • Target

      ee9ebccfe27092cd9602310dd613b493ae72cd25d7b91d48187583578334a2f5

    • Size

      701KB

    • MD5

      2b4644251bb0cb94c0d07a9199e3c32d

    • SHA1

      48ec72482453a696ffc8c5f49f2d6f9f460754f7

    • SHA256

      ee9ebccfe27092cd9602310dd613b493ae72cd25d7b91d48187583578334a2f5

    • SHA512

      bf630a0df47224976fb1932eb400b7aa51da252736f7c44c381966297b0b40e19d2d743688165323798e6e845c707ed736694058efd89c2434cd96b80a69f99d

    • SSDEEP

      12288:Iy90nZ+7eLVXmi+dlPXvf2k4lgG92nEG28o9w2Whl/3prBiWCJDm:IyiaDPvmZGqwHDRrBiHJq

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks