General

  • Target

    4b0c8936ce99e0d4b8a39d0052d285b9b775f956b445e67622f1083302615572

  • Size

    790KB

  • Sample

    241110-bstx3swjas

  • MD5

    4e6d080099b12c576c2893a174a4009c

  • SHA1

    1509c47409b1791dcd509f344aa7cc4ba32413cc

  • SHA256

    4b0c8936ce99e0d4b8a39d0052d285b9b775f956b445e67622f1083302615572

  • SHA512

    767496775fbe0dadaa49350c60f2dcc0be09aec4792454f1bff82b4b2bebcbe9b19f18008799728e6b99020b3293e9256257d9d3a2123bc4723150db4e5f58d3

  • SSDEEP

    12288:KMr3y9092rTVbo6wXipRsmvOwnrBNSKw5Un8NENwLlXi8vligi4AiS61n:tyTZA4BWK2KL8uwdigozWn

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Targets

    • Target

      4b0c8936ce99e0d4b8a39d0052d285b9b775f956b445e67622f1083302615572

    • Size

      790KB

    • MD5

      4e6d080099b12c576c2893a174a4009c

    • SHA1

      1509c47409b1791dcd509f344aa7cc4ba32413cc

    • SHA256

      4b0c8936ce99e0d4b8a39d0052d285b9b775f956b445e67622f1083302615572

    • SHA512

      767496775fbe0dadaa49350c60f2dcc0be09aec4792454f1bff82b4b2bebcbe9b19f18008799728e6b99020b3293e9256257d9d3a2123bc4723150db4e5f58d3

    • SSDEEP

      12288:KMr3y9092rTVbo6wXipRsmvOwnrBNSKw5Un8NENwLlXi8vligi4AiS61n:tyTZA4BWK2KL8uwdigozWn

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks