General

  • Target

    b89c4f31f148f386744359d817adab3a53661404853e12c0a49745af8790e53a

  • Size

    481KB

  • Sample

    241110-bsn2tswgmc

  • MD5

    3ee04b4615722be6eb7adf82ae8bb79a

  • SHA1

    18dd64f8aade617a07fd5149eb3abda4dd5a0bd5

  • SHA256

    b89c4f31f148f386744359d817adab3a53661404853e12c0a49745af8790e53a

  • SHA512

    a0e4af0be326a9525017569f5dbb7117b69a1970144950a1983a9495fb52242a2a246284af71150a51b628be3c8bc36836e0a66825046bbaa43f15e8f16d7be8

  • SSDEEP

    12288:JMr7y906pn3rx5c1u31dTvwHP2GTi6kdR:iy7p3rfXnTWBxkdR

Malware Config

Extracted

Family

redline

Botnet

mihan

C2

217.196.96.101:4132

Attributes
  • auth_value

    9a6a8fdae02ed7caa0a49a6ddc6d4520

Targets

    • Target

      b89c4f31f148f386744359d817adab3a53661404853e12c0a49745af8790e53a

    • Size

      481KB

    • MD5

      3ee04b4615722be6eb7adf82ae8bb79a

    • SHA1

      18dd64f8aade617a07fd5149eb3abda4dd5a0bd5

    • SHA256

      b89c4f31f148f386744359d817adab3a53661404853e12c0a49745af8790e53a

    • SHA512

      a0e4af0be326a9525017569f5dbb7117b69a1970144950a1983a9495fb52242a2a246284af71150a51b628be3c8bc36836e0a66825046bbaa43f15e8f16d7be8

    • SSDEEP

      12288:JMr7y906pn3rx5c1u31dTvwHP2GTi6kdR:iy7p3rfXnTWBxkdR

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks