General

  • Target

    ca942b7355c8da6ba53007cd8342be16fd4466a1d68ab4b891a850ce077fba41

  • Size

    1.1MB

  • Sample

    241110-asjxfavhll

  • MD5

    4451959b003f4e9084b7fef3006fdb10

  • SHA1

    e6e9c7c411f0816eead48df328198bf97aa9bb5b

  • SHA256

    ca942b7355c8da6ba53007cd8342be16fd4466a1d68ab4b891a850ce077fba41

  • SHA512

    ad007a46ba851819713795676a4ba46a51b3c11d7a154f67211afa8155d579b9cfe377b00b7913a86973c09753fdb81aa631d2a60062a96b2ed5e64d47528de9

  • SSDEEP

    24576:2ySljx+EzDcMJ4TPv5AFg2BJQD6X2ZMQphdZkucsunpOK1e:FSl9+gDcMJCPv5sQD6GZ9yucTpO

Malware Config

Extracted

Family

redline

Botnet

ramon

C2

193.233.20.23:4123

Attributes
  • auth_value

    3197576965d9513f115338c233015b40

Targets

    • Target

      ca942b7355c8da6ba53007cd8342be16fd4466a1d68ab4b891a850ce077fba41

    • Size

      1.1MB

    • MD5

      4451959b003f4e9084b7fef3006fdb10

    • SHA1

      e6e9c7c411f0816eead48df328198bf97aa9bb5b

    • SHA256

      ca942b7355c8da6ba53007cd8342be16fd4466a1d68ab4b891a850ce077fba41

    • SHA512

      ad007a46ba851819713795676a4ba46a51b3c11d7a154f67211afa8155d579b9cfe377b00b7913a86973c09753fdb81aa631d2a60062a96b2ed5e64d47528de9

    • SSDEEP

      24576:2ySljx+EzDcMJ4TPv5AFg2BJQD6X2ZMQphdZkucsunpOK1e:FSl9+gDcMJCPv5sQD6GZ9yucTpO

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks