General

  • Target

    9966779fec0beba2f8e5ec1b433403d16da0fbeb7202c14fd26d071f31277ad5

  • Size

    558KB

  • Sample

    241109-xmy6hazeqg

  • MD5

    32e00fcd2f4c23f61c42158875acdf03

  • SHA1

    0d14ab6c6cda79265a3a6a7ea755134efe4489b0

  • SHA256

    9966779fec0beba2f8e5ec1b433403d16da0fbeb7202c14fd26d071f31277ad5

  • SHA512

    e397c430c97cee3c1abd8f12fc2cbeb9f788a935270d2880d18180e716e5e360a87de8354ec4ee9e3f1af9608c3c683267c96afc809a709a7f89812f34b0b4dd

  • SSDEEP

    12288:sy90lJXIwctgAy2N1fB24oKpcCYMQj1R/k:syiJYzgi1p9oKpJYMou

Malware Config

Targets

    • Target

      9966779fec0beba2f8e5ec1b433403d16da0fbeb7202c14fd26d071f31277ad5

    • Size

      558KB

    • MD5

      32e00fcd2f4c23f61c42158875acdf03

    • SHA1

      0d14ab6c6cda79265a3a6a7ea755134efe4489b0

    • SHA256

      9966779fec0beba2f8e5ec1b433403d16da0fbeb7202c14fd26d071f31277ad5

    • SHA512

      e397c430c97cee3c1abd8f12fc2cbeb9f788a935270d2880d18180e716e5e360a87de8354ec4ee9e3f1af9608c3c683267c96afc809a709a7f89812f34b0b4dd

    • SSDEEP

      12288:sy90lJXIwctgAy2N1fB24oKpcCYMQj1R/k:syiJYzgi1p9oKpJYMou

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks