General

  • Target

    2e35ffa75c2d37dc04c9c62bb28ffa946e310c93969616325c83d6ce29348972

  • Size

    794KB

  • Sample

    241109-x16shazhmb

  • MD5

    c5e49ec128d56dcdb670c2917e13815d

  • SHA1

    6f9fd8fc360284a07a4a312b05e1937e57ecb2d7

  • SHA256

    2e35ffa75c2d37dc04c9c62bb28ffa946e310c93969616325c83d6ce29348972

  • SHA512

    e70527924ec3e3871ba92595d5536ed12e99b84a477e08826c21f7abbbb059e692e3a81c2961d0e3d47afc4dccfbf8f271b4fc5352fae0be2481c185ec3f2103

  • SSDEEP

    24576:OyqBxT6Z6eLwNlZUIxfwda69vEvQycPU:dqBxqg74d+Qd

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Targets

    • Target

      2e35ffa75c2d37dc04c9c62bb28ffa946e310c93969616325c83d6ce29348972

    • Size

      794KB

    • MD5

      c5e49ec128d56dcdb670c2917e13815d

    • SHA1

      6f9fd8fc360284a07a4a312b05e1937e57ecb2d7

    • SHA256

      2e35ffa75c2d37dc04c9c62bb28ffa946e310c93969616325c83d6ce29348972

    • SHA512

      e70527924ec3e3871ba92595d5536ed12e99b84a477e08826c21f7abbbb059e692e3a81c2961d0e3d47afc4dccfbf8f271b4fc5352fae0be2481c185ec3f2103

    • SSDEEP

      24576:OyqBxT6Z6eLwNlZUIxfwda69vEvQycPU:dqBxqg74d+Qd

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks