General

  • Target

    7bbc320428370745b4a021fe309ebec93eced5ff2cc0d6074e610d5f0aaea97f

  • Size

    533KB

  • Sample

    241110-awglgsvhrj

  • MD5

    3d7422b8682ccf10afe2d2f04d4b0779

  • SHA1

    2783eb66f6e42b4b5932ad73bcbfd1378966552e

  • SHA256

    7bbc320428370745b4a021fe309ebec93eced5ff2cc0d6074e610d5f0aaea97f

  • SHA512

    4cde09e2d460c47120a33579ab6886aa6c8136c961b4c156e8cc2d89d3ef6316930a7349563b6a8c66ab313fe226a1a5f5707c7b4cee1250ae9a09fad5548f56

  • SSDEEP

    12288:QMr1y904rvsvqsuREk4n6WpcVb8utxswcquu0LCC:1yhvsjCE91etXX0LX

Malware Config

Extracted

Family

redline

Botnet

rumfa

C2

193.233.20.24:4123

Attributes
  • auth_value

    749d02a6b4ef1fa2ad908e44ec2296dc

Targets

    • Target

      7bbc320428370745b4a021fe309ebec93eced5ff2cc0d6074e610d5f0aaea97f

    • Size

      533KB

    • MD5

      3d7422b8682ccf10afe2d2f04d4b0779

    • SHA1

      2783eb66f6e42b4b5932ad73bcbfd1378966552e

    • SHA256

      7bbc320428370745b4a021fe309ebec93eced5ff2cc0d6074e610d5f0aaea97f

    • SHA512

      4cde09e2d460c47120a33579ab6886aa6c8136c961b4c156e8cc2d89d3ef6316930a7349563b6a8c66ab313fe226a1a5f5707c7b4cee1250ae9a09fad5548f56

    • SSDEEP

      12288:QMr1y904rvsvqsuREk4n6WpcVb8utxswcquu0LCC:1yhvsjCE91etXX0LX

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks