General

  • Target

    505f1cf71fd287c909b1855deba5f79a8d7f33374a602dcafc2fc2a2d12833f3

  • Size

    1.1MB

  • Sample

    241110-ckrcnaxdma

  • MD5

    2196fb2415780eec5d0216f1af6590af

  • SHA1

    b012b74f86c0b0cc2dc24694a957e4dfc75f61fe

  • SHA256

    505f1cf71fd287c909b1855deba5f79a8d7f33374a602dcafc2fc2a2d12833f3

  • SHA512

    0aa8c3ffb134024c56c2b33665b37354740a5db1d1548308e3153e12dea7665f3afd5c1d8f48186d51f0c91363cd3f3d1eaf1ce5b543d7e369e5f8d253e4ad3a

  • SSDEEP

    24576:tymQK2g7fmfRycYkacIGxSOjr4TzIZPs0sWhUK3bbiBIoFEBF:ImYam5XYyIGxC/MhDbOG

Malware Config

Extracted

Family

redline

Botnet

rouch

C2

193.56.146.11:4162

Attributes
  • auth_value

    1b1735bcfc122c708eae27ca352568de

Targets

    • Target

      505f1cf71fd287c909b1855deba5f79a8d7f33374a602dcafc2fc2a2d12833f3

    • Size

      1.1MB

    • MD5

      2196fb2415780eec5d0216f1af6590af

    • SHA1

      b012b74f86c0b0cc2dc24694a957e4dfc75f61fe

    • SHA256

      505f1cf71fd287c909b1855deba5f79a8d7f33374a602dcafc2fc2a2d12833f3

    • SHA512

      0aa8c3ffb134024c56c2b33665b37354740a5db1d1548308e3153e12dea7665f3afd5c1d8f48186d51f0c91363cd3f3d1eaf1ce5b543d7e369e5f8d253e4ad3a

    • SSDEEP

      24576:tymQK2g7fmfRycYkacIGxSOjr4TzIZPs0sWhUK3bbiBIoFEBF:ImYam5XYyIGxC/MhDbOG

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks