General

  • Target

    6d0fb75fb1e0ea8e68e58c4898d00660304f4062b7db9584175d69cb53c066a0

  • Size

    1.2MB

  • Sample

    241110-a7tp7avnfw

  • MD5

    d440dd9e6e355c1943690c5b0f7fdb39

  • SHA1

    642e6141e7bfea99b3f98e94a54a5c782b49538f

  • SHA256

    6d0fb75fb1e0ea8e68e58c4898d00660304f4062b7db9584175d69cb53c066a0

  • SHA512

    5e30262443deee8088796d941277000b90595a14b495f9280a6fe5d55a7b55255d37ec4fb298f4ef761af41d152bb69dc5fdbfa5385a292ea9ea6b965242752b

  • SSDEEP

    24576:oCbht9y/vN4jFVkUI4Hiew2ltipvLt87VLLLVxCwaUdw578ObN/4SYrnP4uO:oCz9uyy4Hrw2lt2CxxCwbdw57fQSG

Malware Config

Targets

    • Target

      6d0fb75fb1e0ea8e68e58c4898d00660304f4062b7db9584175d69cb53c066a0

    • Size

      1.2MB

    • MD5

      d440dd9e6e355c1943690c5b0f7fdb39

    • SHA1

      642e6141e7bfea99b3f98e94a54a5c782b49538f

    • SHA256

      6d0fb75fb1e0ea8e68e58c4898d00660304f4062b7db9584175d69cb53c066a0

    • SHA512

      5e30262443deee8088796d941277000b90595a14b495f9280a6fe5d55a7b55255d37ec4fb298f4ef761af41d152bb69dc5fdbfa5385a292ea9ea6b965242752b

    • SSDEEP

      24576:oCbht9y/vN4jFVkUI4Hiew2ltipvLt87VLLLVxCwaUdw578ObN/4SYrnP4uO:oCz9uyy4Hrw2lt2CxxCwbdw57fQSG

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks