General

  • Target

    f5686e906fb1b23c10ffa3c779322a4a68929053f856ee9dd5ede633f277036f

  • Size

    695KB

  • Sample

    241110-bx9t4awfrm

  • MD5

    4c12bf34fb40739e36bb863792042968

  • SHA1

    012164946c6fc6fbc1987ae36a41e916ce2fc2d8

  • SHA256

    f5686e906fb1b23c10ffa3c779322a4a68929053f856ee9dd5ede633f277036f

  • SHA512

    f57522ad05edf9a062b282616d32b908e32c4117a122e36a0a3d9c8e8a5d3e0e4d92f07f57ec26e7edbef0a1181384163b8d18523dc21ee2774b7a94b04f4d7c

  • SSDEEP

    12288:8Mrty90G3tn/wm8K3dX4sAWW93daDz/00LG5UTL5/HiIn+r2T/VVaIeZ8IF04/sa:5yV/w1S4sAL93dOL0YJL5KY26/VveuKB

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Targets

    • Target

      f5686e906fb1b23c10ffa3c779322a4a68929053f856ee9dd5ede633f277036f

    • Size

      695KB

    • MD5

      4c12bf34fb40739e36bb863792042968

    • SHA1

      012164946c6fc6fbc1987ae36a41e916ce2fc2d8

    • SHA256

      f5686e906fb1b23c10ffa3c779322a4a68929053f856ee9dd5ede633f277036f

    • SHA512

      f57522ad05edf9a062b282616d32b908e32c4117a122e36a0a3d9c8e8a5d3e0e4d92f07f57ec26e7edbef0a1181384163b8d18523dc21ee2774b7a94b04f4d7c

    • SSDEEP

      12288:8Mrty90G3tn/wm8K3dX4sAWW93daDz/00LG5UTL5/HiIn+r2T/VVaIeZ8IF04/sa:5yV/w1S4sAL93dOL0YJL5KY26/VveuKB

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks