General

  • Target

    4cef13a26f1030d0a375accecebc4b227c53e1514eb8fd8202c16e2da5e3a176

  • Size

    836KB

  • Sample

    241109-x2n9vazkf1

  • MD5

    23597aa922739a03ee1c71276ff3380f

  • SHA1

    6e3a11b81e53dd14d891f91aea523aa476f4cba6

  • SHA256

    4cef13a26f1030d0a375accecebc4b227c53e1514eb8fd8202c16e2da5e3a176

  • SHA512

    0e17b82d8dd8943d3e8bee45f8e79883e5fce22730b1f566261c0d82f19cea5f6de167f7b74862158ecc473b26e8848f3fee55fb20fbab75219a5128c9418005

  • SSDEEP

    12288:dMrzy90WLgykYqsbUTWyT7IyaAOQ5bPyq91gNYm2cRwah2DlESPYF9ok1O:6ylg1cbUXT7l5jf02Uwah2D+S69okM

Malware Config

Extracted

Family

redline

Botnet

gena

C2

193.233.20.30:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Targets

    • Target

      4cef13a26f1030d0a375accecebc4b227c53e1514eb8fd8202c16e2da5e3a176

    • Size

      836KB

    • MD5

      23597aa922739a03ee1c71276ff3380f

    • SHA1

      6e3a11b81e53dd14d891f91aea523aa476f4cba6

    • SHA256

      4cef13a26f1030d0a375accecebc4b227c53e1514eb8fd8202c16e2da5e3a176

    • SHA512

      0e17b82d8dd8943d3e8bee45f8e79883e5fce22730b1f566261c0d82f19cea5f6de167f7b74862158ecc473b26e8848f3fee55fb20fbab75219a5128c9418005

    • SSDEEP

      12288:dMrzy90WLgykYqsbUTWyT7IyaAOQ5bPyq91gNYm2cRwah2DlESPYF9ok1O:6ylg1cbUXT7l5jf02Uwah2D+S69okM

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks