General

  • Target

    2d7a7cdf26572facfb98f988d304a991d0477a4406a0669d8dce7176eb526de7

  • Size

    965KB

  • Sample

    241110-cme3eaznhm

  • MD5

    1cca50247d47e7934922629639c09dae

  • SHA1

    c903e22a1c69702755cd9a61018e3eebab880f99

  • SHA256

    2d7a7cdf26572facfb98f988d304a991d0477a4406a0669d8dce7176eb526de7

  • SHA512

    9680eaa1b5106b06c0b149b33303db0e935c42bd291fd475213c7de875fc95c98cf59e3e75b74dd730f78d1fd90f995414ea169120e0a2bff14c9b7f00ae575c

  • SSDEEP

    24576:Hy1cjaUHmG8AKOh88HOZIv1ryWcCfC4Rzcszi/:SttG8Aph88HOS9gCq5sO

Malware Config

Targets

    • Target

      2d7a7cdf26572facfb98f988d304a991d0477a4406a0669d8dce7176eb526de7

    • Size

      965KB

    • MD5

      1cca50247d47e7934922629639c09dae

    • SHA1

      c903e22a1c69702755cd9a61018e3eebab880f99

    • SHA256

      2d7a7cdf26572facfb98f988d304a991d0477a4406a0669d8dce7176eb526de7

    • SHA512

      9680eaa1b5106b06c0b149b33303db0e935c42bd291fd475213c7de875fc95c98cf59e3e75b74dd730f78d1fd90f995414ea169120e0a2bff14c9b7f00ae575c

    • SSDEEP

      24576:Hy1cjaUHmG8AKOh88HOZIv1ryWcCfC4Rzcszi/:SttG8Aph88HOS9gCq5sO

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks