General

  • Target

    88ba685f648dac48067e8f3474244939fb811b5221c10fb65ba04c376abb78ee

  • Size

    864KB

  • Sample

    241110-b7qtzaxbkf

  • MD5

    2d41042460ebfe0d5358ac03d225995e

  • SHA1

    a79822b67b5cbfd50070576b665e700d0bac9105

  • SHA256

    88ba685f648dac48067e8f3474244939fb811b5221c10fb65ba04c376abb78ee

  • SHA512

    d2e3ae9d8f0fc81be6dbd7053e10b96a6f06dbb23f87cb11ef7a3122b8913258b4edc872d3548dd922a29020a696a4cd76895c450dd1623c69a775d67efce2f9

  • SSDEEP

    24576:ZybA8EnlCRA86C0qf5jP1J6IvAXD2ds0woUWdmN:MbA3lCMChtnvAXD2GZon

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Targets

    • Target

      88ba685f648dac48067e8f3474244939fb811b5221c10fb65ba04c376abb78ee

    • Size

      864KB

    • MD5

      2d41042460ebfe0d5358ac03d225995e

    • SHA1

      a79822b67b5cbfd50070576b665e700d0bac9105

    • SHA256

      88ba685f648dac48067e8f3474244939fb811b5221c10fb65ba04c376abb78ee

    • SHA512

      d2e3ae9d8f0fc81be6dbd7053e10b96a6f06dbb23f87cb11ef7a3122b8913258b4edc872d3548dd922a29020a696a4cd76895c450dd1623c69a775d67efce2f9

    • SSDEEP

      24576:ZybA8EnlCRA86C0qf5jP1J6IvAXD2ds0woUWdmN:MbA3lCMChtnvAXD2GZon

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks