General

  • Target

    a90116f23cbad691d171e1cd0c7aecdfe910de52403c357e51249b3f19497aa1

  • Size

    650KB

  • Sample

    241110-d13ajayflg

  • MD5

    b32abd0a149599f3e15a115a2adebcdd

  • SHA1

    06997813e100aa4e4782e86276af631246db68b9

  • SHA256

    a90116f23cbad691d171e1cd0c7aecdfe910de52403c357e51249b3f19497aa1

  • SHA512

    026bb97916d789f5b4a1cd06e0bda54828904b7c8bd0f2117474feca1ef57b71c4322d4db90a92057f76e55bdb447453cda588e7d92413da081a3c266c1e280b

  • SSDEEP

    12288:GMrVy90JgkSXGpzNZgAKEUlpkqndCu9cKn8zjP3dUbD9jeuLLzkLUG:rygtXgAfcQu9cKn8XP3d+AuO

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Targets

    • Target

      a90116f23cbad691d171e1cd0c7aecdfe910de52403c357e51249b3f19497aa1

    • Size

      650KB

    • MD5

      b32abd0a149599f3e15a115a2adebcdd

    • SHA1

      06997813e100aa4e4782e86276af631246db68b9

    • SHA256

      a90116f23cbad691d171e1cd0c7aecdfe910de52403c357e51249b3f19497aa1

    • SHA512

      026bb97916d789f5b4a1cd06e0bda54828904b7c8bd0f2117474feca1ef57b71c4322d4db90a92057f76e55bdb447453cda588e7d92413da081a3c266c1e280b

    • SSDEEP

      12288:GMrVy90JgkSXGpzNZgAKEUlpkqndCu9cKn8zjP3dUbD9jeuLLzkLUG:rygtXgAfcQu9cKn8XP3d+AuO

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks