General

  • Target

    21f457c5e1500e5dd8b750a8e6dd1426bd8a81c66efc85126f3d8fbf6a151e93N.exe

  • Size

    468KB

  • Sample

    241110-16splswkhs

  • MD5

    d46866358c2f21ecd6696516aa0007d6

  • SHA1

    878c5f0d4e8a77693ff905fc05bf63a9aacf2303

  • SHA256

    98976b44ca88d8a3b7bbc984f24441e2589c07a673c0d13b999690047328831d

  • SHA512

    1a75b27ba7c9aa5a48ceefb9a1400c321a0e336bc9054f801ef2c376513d3a733543214cfd9241889ec102fddd40665a44692d355e9d5b9b069824ad44a4d780

  • SSDEEP

    12288:py90F/j+rUKX8WJzt//HQBrfzWOOWE/Fz4Sj:pyuyZt//w9fzROTdJj

Malware Config

Targets

    • Target

      21f457c5e1500e5dd8b750a8e6dd1426bd8a81c66efc85126f3d8fbf6a151e93N.exe

    • Size

      468KB

    • MD5

      d46866358c2f21ecd6696516aa0007d6

    • SHA1

      878c5f0d4e8a77693ff905fc05bf63a9aacf2303

    • SHA256

      98976b44ca88d8a3b7bbc984f24441e2589c07a673c0d13b999690047328831d

    • SHA512

      1a75b27ba7c9aa5a48ceefb9a1400c321a0e336bc9054f801ef2c376513d3a733543214cfd9241889ec102fddd40665a44692d355e9d5b9b069824ad44a4d780

    • SSDEEP

      12288:py90F/j+rUKX8WJzt//HQBrfzWOOWE/Fz4Sj:pyuyZt//w9fzROTdJj

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks