General

  • Target

    aa28a688eead307a11e2eb0a78fe7e10086f7d311cd53cee54a6c415bbd87f43

  • Size

    658KB

  • Sample

    241109-gs6jrsyhql

  • MD5

    bd499b9b7ce3864bb0faa8bd2b9f01e2

  • SHA1

    0719c0a4a9724bd4138d7eb73ec0d39567d978ca

  • SHA256

    aa28a688eead307a11e2eb0a78fe7e10086f7d311cd53cee54a6c415bbd87f43

  • SHA512

    03a6392d5a60534569c36871b3cf8951788d5d3e72b1f073896d8e6fa3f35adfff94d78fa398dc1c289abed9064500bb7201fd9b502438552f9e4efe2bf18e7f

  • SSDEEP

    12288:sMr5y90fTAuNx3Vk3QN6OIc3F1+s+bViVXo2pzuiGs4bf4NO1OKjZEH2z:Ny6AyVV4D80rWXohiGsOOEmWz

Malware Config

Extracted

Family

redline

Botnet

rosto

C2

hueref.eu:4162

Attributes
  • auth_value

    07d81eba8cad42bbd0ae60042d48eac6

Targets

    • Target

      aa28a688eead307a11e2eb0a78fe7e10086f7d311cd53cee54a6c415bbd87f43

    • Size

      658KB

    • MD5

      bd499b9b7ce3864bb0faa8bd2b9f01e2

    • SHA1

      0719c0a4a9724bd4138d7eb73ec0d39567d978ca

    • SHA256

      aa28a688eead307a11e2eb0a78fe7e10086f7d311cd53cee54a6c415bbd87f43

    • SHA512

      03a6392d5a60534569c36871b3cf8951788d5d3e72b1f073896d8e6fa3f35adfff94d78fa398dc1c289abed9064500bb7201fd9b502438552f9e4efe2bf18e7f

    • SSDEEP

      12288:sMr5y90fTAuNx3Vk3QN6OIc3F1+s+bViVXo2pzuiGs4bf4NO1OKjZEH2z:Ny6AyVV4D80rWXohiGsOOEmWz

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks