General

  • Target

    36b048c8d5547e89699822c4e0e0605817a56779e39b518fcc2b2e9a7fb28995

  • Size

    1.0MB

  • Sample

    241110-a7hypavnfs

  • MD5

    9396d3c19d385fa5f10e5ab32ea45175

  • SHA1

    759049720e1e70ae1bc8b4dcb238fab7bf120bd2

  • SHA256

    36b048c8d5547e89699822c4e0e0605817a56779e39b518fcc2b2e9a7fb28995

  • SHA512

    df296d585422e8d9df1350c18541ef0bac030a676a3cf193e721b587919295cf06d75ab99b9b9e956af77c461cd661feafb7837e79a8ee47530feb4f29fc6251

  • SSDEEP

    24576:KyE+pINoVPNAOqnQZMFvTaFKCIw7tPYackj7Rbhu78:REgINglA2wgPYNOt1u7

Malware Config

Targets

    • Target

      36b048c8d5547e89699822c4e0e0605817a56779e39b518fcc2b2e9a7fb28995

    • Size

      1.0MB

    • MD5

      9396d3c19d385fa5f10e5ab32ea45175

    • SHA1

      759049720e1e70ae1bc8b4dcb238fab7bf120bd2

    • SHA256

      36b048c8d5547e89699822c4e0e0605817a56779e39b518fcc2b2e9a7fb28995

    • SHA512

      df296d585422e8d9df1350c18541ef0bac030a676a3cf193e721b587919295cf06d75ab99b9b9e956af77c461cd661feafb7837e79a8ee47530feb4f29fc6251

    • SSDEEP

      24576:KyE+pINoVPNAOqnQZMFvTaFKCIw7tPYackj7Rbhu78:REgINglA2wgPYNOt1u7

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks