General

  • Target

    0126ea9a8d72978d2797dede1979989cb5341901b488ec1a24e6585a1ed6a765

  • Size

    415KB

  • Sample

    241109-xr5tvasrap

  • MD5

    32633f4d71887148bda0bea774f37b66

  • SHA1

    089ead8d61c325be9b8fbde3a0254ba132b24a0e

  • SHA256

    0126ea9a8d72978d2797dede1979989cb5341901b488ec1a24e6585a1ed6a765

  • SHA512

    a40db8743d638df9ead3c303eedb519c9ed64cafd5a937794b93f69a0b75b5c4d164acfa38906799a753f77793b844a3e0d9c4993f5b85792f5a69fa334ee39c

  • SSDEEP

    6144:KBy+bnr+Tp0yN90QECoP1ZdOmaC19zEfRSPBUqRtX+8xvAvK+KQc4WFamAuTHux5:jMrXy90QOZQs1k0aqusZ+K1jAuNI9

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes
  • auth_value

    3d2870537d84a4c6d7aeecd002871c51

Targets

    • Target

      0126ea9a8d72978d2797dede1979989cb5341901b488ec1a24e6585a1ed6a765

    • Size

      415KB

    • MD5

      32633f4d71887148bda0bea774f37b66

    • SHA1

      089ead8d61c325be9b8fbde3a0254ba132b24a0e

    • SHA256

      0126ea9a8d72978d2797dede1979989cb5341901b488ec1a24e6585a1ed6a765

    • SHA512

      a40db8743d638df9ead3c303eedb519c9ed64cafd5a937794b93f69a0b75b5c4d164acfa38906799a753f77793b844a3e0d9c4993f5b85792f5a69fa334ee39c

    • SSDEEP

      6144:KBy+bnr+Tp0yN90QECoP1ZdOmaC19zEfRSPBUqRtX+8xvAvK+KQc4WFamAuTHux5:jMrXy90QOZQs1k0aqusZ+K1jAuNI9

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks