General

  • Target

    681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a

  • Size

    787KB

  • Sample

    241109-gyzneazamq

  • MD5

    d4234be88660b5c6acb53b22f070caa1

  • SHA1

    4cf464bab92c9c4324645dc571537a3f94b8da0b

  • SHA256

    681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a

  • SHA512

    5dc9a92c5acd2d2c689a756c1e7e88f7adb4aef37e4d920f8e00fcc6a272fe82dc4ea9657306bb8d127be5ff53aa59840e7b4ea4d8cc4297325f5a3363c2bd54

  • SSDEEP

    12288:6MrIy90RIN78tEmh1N9XyoYtJRMRVDciPEpnU3k61jdgokXrjOV:2yN8t/lXQtJiHPEhU3kelk7ju

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Targets

    • Target

      681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a

    • Size

      787KB

    • MD5

      d4234be88660b5c6acb53b22f070caa1

    • SHA1

      4cf464bab92c9c4324645dc571537a3f94b8da0b

    • SHA256

      681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a

    • SHA512

      5dc9a92c5acd2d2c689a756c1e7e88f7adb4aef37e4d920f8e00fcc6a272fe82dc4ea9657306bb8d127be5ff53aa59840e7b4ea4d8cc4297325f5a3363c2bd54

    • SSDEEP

      12288:6MrIy90RIN78tEmh1N9XyoYtJRMRVDciPEpnU3k61jdgokXrjOV:2yN8t/lXQtJiHPEhU3kelk7ju

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks