General

  • Target

    749fc338e27160fd4d1bd43187e449dfd92f2552f0feb6405128eaa7da2c45da

  • Size

    479KB

  • Sample

    241110-b2e6aawkfx

  • MD5

    7c19f24c815f3bb38fe4958153a69b5a

  • SHA1

    1616a4c4e6bd8c274b6566c8186ace089bacaee1

  • SHA256

    749fc338e27160fd4d1bd43187e449dfd92f2552f0feb6405128eaa7da2c45da

  • SHA512

    33790b6a1bf22fa9fa10780c7c06d31fbe8195fbef49deb793e6f5f1c9ca000063a9314639bc098a19b3ac67848f7083e8e2b224604270a8ccb75ee2be245256

  • SSDEEP

    12288:IMray90Q/2bWFzFZCX1lDBYOgsa7SBu00fkKA:yyAWpDCFtiOgHyu2KA

Malware Config

Extracted

Family

redline

Botnet

dona

C2

217.196.96.101:4132

Attributes
  • auth_value

    9fbb198992bbc83a84ab1f21384813e3

Targets

    • Target

      749fc338e27160fd4d1bd43187e449dfd92f2552f0feb6405128eaa7da2c45da

    • Size

      479KB

    • MD5

      7c19f24c815f3bb38fe4958153a69b5a

    • SHA1

      1616a4c4e6bd8c274b6566c8186ace089bacaee1

    • SHA256

      749fc338e27160fd4d1bd43187e449dfd92f2552f0feb6405128eaa7da2c45da

    • SHA512

      33790b6a1bf22fa9fa10780c7c06d31fbe8195fbef49deb793e6f5f1c9ca000063a9314639bc098a19b3ac67848f7083e8e2b224604270a8ccb75ee2be245256

    • SSDEEP

      12288:IMray90Q/2bWFzFZCX1lDBYOgsa7SBu00fkKA:yyAWpDCFtiOgHyu2KA

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks