General

  • Target

    34d6dfbbbcc3b00df0239abc99d13989384b59c2fb0cdebfa01210c8065c9b4b

  • Size

    654KB

  • Sample

    241110-a49l8svnby

  • MD5

    9b12bd81624de99df8113c976e474e3e

  • SHA1

    289acd3da5807fcb8b9c3e49be213215fd86957e

  • SHA256

    34d6dfbbbcc3b00df0239abc99d13989384b59c2fb0cdebfa01210c8065c9b4b

  • SHA512

    426c40871a2df6ec4cdf3c6ec290f60feb4e030d2b374e5dd24835a2ec9991cf12751777069a4d1ffaba21d11ad22c95ebd769982bb805e8089c482cca3a6a56

  • SSDEEP

    12288:WMrjy90TACtyDCVSila1kadCrVTuu92rCuSwd5wT/7VpZaKKclFyZowfN:FyAA3CcyaMgCwd56/7HZaKbyZDN

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Targets

    • Target

      34d6dfbbbcc3b00df0239abc99d13989384b59c2fb0cdebfa01210c8065c9b4b

    • Size

      654KB

    • MD5

      9b12bd81624de99df8113c976e474e3e

    • SHA1

      289acd3da5807fcb8b9c3e49be213215fd86957e

    • SHA256

      34d6dfbbbcc3b00df0239abc99d13989384b59c2fb0cdebfa01210c8065c9b4b

    • SHA512

      426c40871a2df6ec4cdf3c6ec290f60feb4e030d2b374e5dd24835a2ec9991cf12751777069a4d1ffaba21d11ad22c95ebd769982bb805e8089c482cca3a6a56

    • SSDEEP

      12288:WMrjy90TACtyDCVSila1kadCrVTuu92rCuSwd5wT/7VpZaKKclFyZowfN:FyAA3CcyaMgCwd56/7HZaKbyZDN

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks