General

  • Target

    d6dc154ee4f7deb5d6ea4d517ef696b6da3819a06e91b574b1382cb36bd29466

  • Size

    660KB

  • Sample

    241110-b16a3szkbp

  • MD5

    a1868839dfa3db298827f2f0aa159c2d

  • SHA1

    b97940ceeff790552d1274eb41e1071cbee7948d

  • SHA256

    d6dc154ee4f7deb5d6ea4d517ef696b6da3819a06e91b574b1382cb36bd29466

  • SHA512

    f6a41544c222d1473337f0c8cafa93596bf87fd492ac4f6884543a52ee5a8171bdc72a3828c86950b582f872ed8ee971fc172e484dfee81169f5ea94a04af611

  • SSDEEP

    12288:vMrWy90QP0g7aw+kaY6oACkrI2zhwTe78M513cykrTDJoy9l3N7:dyXaw/wwS8M513cykXqq59

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

dozt

C2

77.91.124.145:4125

Attributes
  • auth_value

    857bdfe4fa14711025859d89f18b32cb

Targets

    • Target

      d6dc154ee4f7deb5d6ea4d517ef696b6da3819a06e91b574b1382cb36bd29466

    • Size

      660KB

    • MD5

      a1868839dfa3db298827f2f0aa159c2d

    • SHA1

      b97940ceeff790552d1274eb41e1071cbee7948d

    • SHA256

      d6dc154ee4f7deb5d6ea4d517ef696b6da3819a06e91b574b1382cb36bd29466

    • SHA512

      f6a41544c222d1473337f0c8cafa93596bf87fd492ac4f6884543a52ee5a8171bdc72a3828c86950b582f872ed8ee971fc172e484dfee81169f5ea94a04af611

    • SSDEEP

      12288:vMrWy90QP0g7aw+kaY6oACkrI2zhwTe78M513cykrTDJoy9l3N7:dyXaw/wwS8M513cykXqq59

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks