General

  • Target

    e3ce6011a29d6b7782fb2f0aac114aabd2970f83daf5de9af1ad3b43c7ce084eN

  • Size

    751KB

  • Sample

    241110-av3gkavlds

  • MD5

    2cb80efba03d8d948b61b72da0d7fb70

  • SHA1

    f3594d5fc30bb8afd54b74139a9e839c175ed39f

  • SHA256

    e3ce6011a29d6b7782fb2f0aac114aabd2970f83daf5de9af1ad3b43c7ce084e

  • SHA512

    cd0ea4cc75f192267fb829143393b4ff7d9a8522834a5d4d79c7264f103e302e0b1f8a084e522e4cab9cbe44a1d1e28eacdf1c3e279a0db6c5ab06af19258c83

  • SSDEEP

    12288:ay90QTXS4MwNB20b8HSYgz4k5LwgQ/qYpz+Vi15HgGiI5HuYKO83hg4MIC:ay/i4RNY0wng0kJwsYpz+VirAGBnYe0C

Malware Config

Targets

    • Target

      e3ce6011a29d6b7782fb2f0aac114aabd2970f83daf5de9af1ad3b43c7ce084eN

    • Size

      751KB

    • MD5

      2cb80efba03d8d948b61b72da0d7fb70

    • SHA1

      f3594d5fc30bb8afd54b74139a9e839c175ed39f

    • SHA256

      e3ce6011a29d6b7782fb2f0aac114aabd2970f83daf5de9af1ad3b43c7ce084e

    • SHA512

      cd0ea4cc75f192267fb829143393b4ff7d9a8522834a5d4d79c7264f103e302e0b1f8a084e522e4cab9cbe44a1d1e28eacdf1c3e279a0db6c5ab06af19258c83

    • SSDEEP

      12288:ay90QTXS4MwNB20b8HSYgz4k5LwgQ/qYpz+Vi15HgGiI5HuYKO83hg4MIC:ay/i4RNY0wng0kJwsYpz+VirAGBnYe0C

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks