General

  • Target

    7c9439ba5435f4011ac17fd1cc17c271d6c5253453bdc8240aeadc735470cfe3

  • Size

    697KB

  • Sample

    241110-a6ybzswbnm

  • MD5

    892238a4cb55ad313f61148df879c812

  • SHA1

    6a13b8a16f5b20deff0620c8c41ae8cf6a7cb187

  • SHA256

    7c9439ba5435f4011ac17fd1cc17c271d6c5253453bdc8240aeadc735470cfe3

  • SHA512

    2e3b4a8c525cb50683c15869f96a8f295da63e814249382795450c7b77e62e1b46b06fd8257571740992cdb11af7ab90eac3453ae1cb37618a0a3b359d1276ab

  • SSDEEP

    12288:yy90Ddmerl+WGEtMeZEP3musw1TRLy2dbVej4BBvhTI:yyGhsWI3mLIy2vMGvs

Malware Config

Targets

    • Target

      7c9439ba5435f4011ac17fd1cc17c271d6c5253453bdc8240aeadc735470cfe3

    • Size

      697KB

    • MD5

      892238a4cb55ad313f61148df879c812

    • SHA1

      6a13b8a16f5b20deff0620c8c41ae8cf6a7cb187

    • SHA256

      7c9439ba5435f4011ac17fd1cc17c271d6c5253453bdc8240aeadc735470cfe3

    • SHA512

      2e3b4a8c525cb50683c15869f96a8f295da63e814249382795450c7b77e62e1b46b06fd8257571740992cdb11af7ab90eac3453ae1cb37618a0a3b359d1276ab

    • SSDEEP

      12288:yy90Ddmerl+WGEtMeZEP3musw1TRLy2dbVej4BBvhTI:yyGhsWI3mLIy2vMGvs

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks