General

  • Target

    a5576efd86527570af773be32e81e13c6f800a01b37c70d2e4d5870247776af4

  • Size

    723KB

  • Sample

    241110-bpap2awfnf

  • MD5

    f40ea43b07ba9a99a46a16f417f39f30

  • SHA1

    93f3a3ac48aa06121901017d93451b1427bd2b30

  • SHA256

    a5576efd86527570af773be32e81e13c6f800a01b37c70d2e4d5870247776af4

  • SHA512

    f1a3d23623ae3fa9c647518b09ed7b80d58ed61c025120197cdeda8f1705394a0754321cecb5bf4e23ecd5fd811e9d4b78f33e4cf5ca31bf583ba9c8262950bf

  • SSDEEP

    12288:tMrwy90+wX9MPF1JxREmxlJ/6vu/7QrYZg8+QnZfnttOuhQBHyxfGM2TRZ3e:FygCPFTxzd6vu/7la1mZftnhQlUGMcZu

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

diza

C2

185.161.248.90:4125

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      a5576efd86527570af773be32e81e13c6f800a01b37c70d2e4d5870247776af4

    • Size

      723KB

    • MD5

      f40ea43b07ba9a99a46a16f417f39f30

    • SHA1

      93f3a3ac48aa06121901017d93451b1427bd2b30

    • SHA256

      a5576efd86527570af773be32e81e13c6f800a01b37c70d2e4d5870247776af4

    • SHA512

      f1a3d23623ae3fa9c647518b09ed7b80d58ed61c025120197cdeda8f1705394a0754321cecb5bf4e23ecd5fd811e9d4b78f33e4cf5ca31bf583ba9c8262950bf

    • SSDEEP

      12288:tMrwy90+wX9MPF1JxREmxlJ/6vu/7QrYZg8+QnZfnttOuhQBHyxfGM2TRZ3e:FygCPFTxzd6vu/7la1mZftnhQlUGMcZu

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks