General

  • Target

    0ace34e17d5adc9b4769716d17c69c45e009bb74c6146cf21f25aacd72a94746

  • Size

    522KB

  • Sample

    241110-b868cawmbv

  • MD5

    7eeaebca48e66bc48eb1b8d4fdf9c475

  • SHA1

    2b8f7a8da06490bbd32f5ac62cb646d59fabfae9

  • SHA256

    0ace34e17d5adc9b4769716d17c69c45e009bb74c6146cf21f25aacd72a94746

  • SHA512

    235bf2f958223efc7272d455de827dcf474b3c721caf6777b7bf2ed7bd47a4180daf2d6eddb30640da5e940a50e07d3b9d9bf90a0f96cb0ca155e85dc03ab90b

  • SSDEEP

    12288:/Mrby90iPO5fY6D0FmrTr58Pr28xO4vEzWK/iNveQureoc:Qy8YYnrTyr/xnvtKeVoc

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Targets

    • Target

      0ace34e17d5adc9b4769716d17c69c45e009bb74c6146cf21f25aacd72a94746

    • Size

      522KB

    • MD5

      7eeaebca48e66bc48eb1b8d4fdf9c475

    • SHA1

      2b8f7a8da06490bbd32f5ac62cb646d59fabfae9

    • SHA256

      0ace34e17d5adc9b4769716d17c69c45e009bb74c6146cf21f25aacd72a94746

    • SHA512

      235bf2f958223efc7272d455de827dcf474b3c721caf6777b7bf2ed7bd47a4180daf2d6eddb30640da5e940a50e07d3b9d9bf90a0f96cb0ca155e85dc03ab90b

    • SSDEEP

      12288:/Mrby90iPO5fY6D0FmrTr58Pr28xO4vEzWK/iNveQureoc:Qy8YYnrTyr/xnvtKeVoc

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks