General

  • Target

    6d0539ca7847e68365a0cc6559b4498522abc74af8b508fd72a6f7ed46741437

  • Size

    533KB

  • Sample

    241109-gtsz3ayhqp

  • MD5

    5ea25d0fb1c378c1ed9363cb006e7b37

  • SHA1

    b68a61b3ca1043fefd6c1fd9767566d0872d65d1

  • SHA256

    6d0539ca7847e68365a0cc6559b4498522abc74af8b508fd72a6f7ed46741437

  • SHA512

    033ff2059dbdeb00aa8620720bd66e198d9078339215f633f8dd2540530fa4131033dd15bfe65c8efed13f74a52dd01b9082dc57bc87ae239b962b87cb55c8fd

  • SSDEEP

    12288:WMrYy90R82+jc2eDMVQzCTInHAFLGEGOburaSiEycE/S8Q:ay2+QPMVQzkeifbrSilc2lQ

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Targets

    • Target

      6d0539ca7847e68365a0cc6559b4498522abc74af8b508fd72a6f7ed46741437

    • Size

      533KB

    • MD5

      5ea25d0fb1c378c1ed9363cb006e7b37

    • SHA1

      b68a61b3ca1043fefd6c1fd9767566d0872d65d1

    • SHA256

      6d0539ca7847e68365a0cc6559b4498522abc74af8b508fd72a6f7ed46741437

    • SHA512

      033ff2059dbdeb00aa8620720bd66e198d9078339215f633f8dd2540530fa4131033dd15bfe65c8efed13f74a52dd01b9082dc57bc87ae239b962b87cb55c8fd

    • SSDEEP

      12288:WMrYy90R82+jc2eDMVQzCTInHAFLGEGOburaSiEycE/S8Q:ay2+QPMVQzkeifbrSilc2lQ

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks