General

  • Target

    96d817adc2f5f91289b0c5ddf11dfe84238a2bcd426fbf05cc08ec0970a8ffa9

  • Size

    652KB

  • Sample

    241110-bnxs6syqem

  • MD5

    d0e332f65e8f8b29622d2f969363f24f

  • SHA1

    18aead52dc0834cbd2bf94017be4e1a67dc6dca6

  • SHA256

    96d817adc2f5f91289b0c5ddf11dfe84238a2bcd426fbf05cc08ec0970a8ffa9

  • SHA512

    ca9ff650cf5e04eacd923e5b5737c437ba5facf42e4d33210efbb7b7238dbf8620c9db3a0699fb44e48898bd4c9d96379b45e14874ba714072d0899d82025e86

  • SSDEEP

    12288:pMrKy90mqLNx+SuL1qofTyqLiYrV+PQYOVtYeUYYrAmJLZt:/yCLqSuL1zuPZZTrAmVX

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Targets

    • Target

      96d817adc2f5f91289b0c5ddf11dfe84238a2bcd426fbf05cc08ec0970a8ffa9

    • Size

      652KB

    • MD5

      d0e332f65e8f8b29622d2f969363f24f

    • SHA1

      18aead52dc0834cbd2bf94017be4e1a67dc6dca6

    • SHA256

      96d817adc2f5f91289b0c5ddf11dfe84238a2bcd426fbf05cc08ec0970a8ffa9

    • SHA512

      ca9ff650cf5e04eacd923e5b5737c437ba5facf42e4d33210efbb7b7238dbf8620c9db3a0699fb44e48898bd4c9d96379b45e14874ba714072d0899d82025e86

    • SSDEEP

      12288:pMrKy90mqLNx+SuL1qofTyqLiYrV+PQYOVtYeUYYrAmJLZt:/yCLqSuL1zuPZZTrAmVX

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks