General

  • Target

    bf975707077f5556d3c475aec5d27d5e96a67409d9fccff76940d4e3e4f0f02d

  • Size

    819KB

  • Sample

    241110-b2x14awgnp

  • MD5

    9515a4fe10ae203ec68485c0157e888f

  • SHA1

    16484c5936edb70fa23c64332c567cdeec8c0eae

  • SHA256

    bf975707077f5556d3c475aec5d27d5e96a67409d9fccff76940d4e3e4f0f02d

  • SHA512

    625024a341574a0ed24e507248127b6563b75ab8d8c7092f080954cda9233deaa9b0b4f8ab1341dca4297e99a8799cc1e2d77bae50bd098f62c43b45575e57ed

  • SSDEEP

    24576:myslQyHOM6lAdC/Ly1mqFAlVwZ/3A4gXnW4bBJ:1RyHOMCAsLydF42p3A4gXW4b

Malware Config

Extracted

Family

redline

Botnet

gena

C2

193.233.20.30:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Targets

    • Target

      bf975707077f5556d3c475aec5d27d5e96a67409d9fccff76940d4e3e4f0f02d

    • Size

      819KB

    • MD5

      9515a4fe10ae203ec68485c0157e888f

    • SHA1

      16484c5936edb70fa23c64332c567cdeec8c0eae

    • SHA256

      bf975707077f5556d3c475aec5d27d5e96a67409d9fccff76940d4e3e4f0f02d

    • SHA512

      625024a341574a0ed24e507248127b6563b75ab8d8c7092f080954cda9233deaa9b0b4f8ab1341dca4297e99a8799cc1e2d77bae50bd098f62c43b45575e57ed

    • SSDEEP

      24576:myslQyHOM6lAdC/Ly1mqFAlVwZ/3A4gXnW4bBJ:1RyHOMCAsLydF42p3A4gXW4b

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks