General

  • Target

    2575cda9aa44d0d91d606954d26869683039546481cd9ac82b68ed0c47c31536

  • Size

    479KB

  • Sample

    241110-cfvvaazmgm

  • MD5

    3140bec16ecfca811d72bc2c50c8124c

  • SHA1

    45fe984dd058c767f94fd2f4437cae1993bcfd73

  • SHA256

    2575cda9aa44d0d91d606954d26869683039546481cd9ac82b68ed0c47c31536

  • SHA512

    9249be2071f66f40200e8ae36952289248ed7b9cbe66703b1af27bcb1889fdecfc2289e01c9a98f2b66ab4c83e494f0abb6a27c22520aa360f3d2d321eef68ff

  • SSDEEP

    12288:KMriy90MzRdotVyKGsjOGP2KNnmaQOZxeQKpoV3O:0ypzNK9P2EQO38GV+

Malware Config

Extracted

Family

redline

Botnet

dona

C2

217.196.96.101:4132

Attributes
  • auth_value

    9fbb198992bbc83a84ab1f21384813e3

Targets

    • Target

      2575cda9aa44d0d91d606954d26869683039546481cd9ac82b68ed0c47c31536

    • Size

      479KB

    • MD5

      3140bec16ecfca811d72bc2c50c8124c

    • SHA1

      45fe984dd058c767f94fd2f4437cae1993bcfd73

    • SHA256

      2575cda9aa44d0d91d606954d26869683039546481cd9ac82b68ed0c47c31536

    • SHA512

      9249be2071f66f40200e8ae36952289248ed7b9cbe66703b1af27bcb1889fdecfc2289e01c9a98f2b66ab4c83e494f0abb6a27c22520aa360f3d2d321eef68ff

    • SSDEEP

      12288:KMriy90MzRdotVyKGsjOGP2KNnmaQOZxeQKpoV3O:0ypzNK9P2EQO38GV+

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks