General

  • Target

    ca128eb5983301b72298f82f1d5d0327dd540a28772b3344d891244c86b98abf

  • Size

    480KB

  • Sample

    241109-xl3gjazepe

  • MD5

    c279ef7247683e1e7078e37757f98b2b

  • SHA1

    095eba6fe5a256f8d227a25e18f3e78e49e778e1

  • SHA256

    ca128eb5983301b72298f82f1d5d0327dd540a28772b3344d891244c86b98abf

  • SHA512

    1feccdfd4557f56ffedf2b242011f13b63e27681df1d7ffbbb73439d6e3329aafcd442fa83dd604d07d304c336a940e298bd176e642807702ef2127baecbd2aa

  • SSDEEP

    12288:LMr9y90RWFdUXvPomew3NKS/1oVbFW6z33FUiy6hRt8ktiGZPV:qyyWFGPfd/CE67VFV

Malware Config

Extracted

Family

redline

Botnet

misfa

C2

217.196.96.101:4132

Attributes
  • auth_value

    be2e6d9f1a5e54a81340947b20e561c1

Targets

    • Target

      ca128eb5983301b72298f82f1d5d0327dd540a28772b3344d891244c86b98abf

    • Size

      480KB

    • MD5

      c279ef7247683e1e7078e37757f98b2b

    • SHA1

      095eba6fe5a256f8d227a25e18f3e78e49e778e1

    • SHA256

      ca128eb5983301b72298f82f1d5d0327dd540a28772b3344d891244c86b98abf

    • SHA512

      1feccdfd4557f56ffedf2b242011f13b63e27681df1d7ffbbb73439d6e3329aafcd442fa83dd604d07d304c336a940e298bd176e642807702ef2127baecbd2aa

    • SSDEEP

      12288:LMr9y90RWFdUXvPomew3NKS/1oVbFW6z33FUiy6hRt8ktiGZPV:qyyWFGPfd/CE67VFV

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks