General

  • Target

    4eea796403a7698011eb87b98fa7c56b8f93ec607f869a69ac7211a77f9aec8a

  • Size

    1.0MB

  • Sample

    241110-b4actawgqn

  • MD5

    a4a761bbbe236424c0f5679dc669c1da

  • SHA1

    57620fe2dc503b26ee2499f6f9bf55c64c7a4167

  • SHA256

    4eea796403a7698011eb87b98fa7c56b8f93ec607f869a69ac7211a77f9aec8a

  • SHA512

    1c0d866592ea86933827d7fd4661e6b5a04134c3176ec78be5fff32e1836cf1502b5da0d610c571a91079b60b18a185e125d03593fe46523906f8ae20a6a3c89

  • SSDEEP

    24576:nyqPeXFiGioM9czm2/aSOZFppqFLzJ4bRk:yRFEoMDSMX

Malware Config

Targets

    • Target

      4eea796403a7698011eb87b98fa7c56b8f93ec607f869a69ac7211a77f9aec8a

    • Size

      1.0MB

    • MD5

      a4a761bbbe236424c0f5679dc669c1da

    • SHA1

      57620fe2dc503b26ee2499f6f9bf55c64c7a4167

    • SHA256

      4eea796403a7698011eb87b98fa7c56b8f93ec607f869a69ac7211a77f9aec8a

    • SHA512

      1c0d866592ea86933827d7fd4661e6b5a04134c3176ec78be5fff32e1836cf1502b5da0d610c571a91079b60b18a185e125d03593fe46523906f8ae20a6a3c89

    • SSDEEP

      24576:nyqPeXFiGioM9czm2/aSOZFppqFLzJ4bRk:yRFEoMDSMX

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks