General

  • Target

    dc5e5c59ca1a27d049a056ec33c05ccb53cda43e264871999f717bde4ad1e74e

  • Size

    659KB

  • Sample

    241110-d2h82syfmh

  • MD5

    2c7a1fab26ce5f143044435c36e5b9f1

  • SHA1

    29d1e2eabde076cc61af1dda480a12d822a2077f

  • SHA256

    dc5e5c59ca1a27d049a056ec33c05ccb53cda43e264871999f717bde4ad1e74e

  • SHA512

    a6dca44b77dfe23de4f3ec5ab203af208824f364c7f0397c0ecd516cf0bc4d058f59dcfb124c2488385bfe15fce317c84b1ee6a110a6af0969fc678fbbfea215

  • SSDEEP

    12288:fMrly90SsKTkUruSd9x6UFvfObm3r8RdVPC78jfyOn39pkBfxCfHf8mn6xJtGrK:yy1stN9UFOQre0wb39hHUOgF

Malware Config

Extracted

Family

redline

Botnet

rosto

C2

hueref.eu:4162

Attributes
  • auth_value

    07d81eba8cad42bbd0ae60042d48eac6

Targets

    • Target

      dc5e5c59ca1a27d049a056ec33c05ccb53cda43e264871999f717bde4ad1e74e

    • Size

      659KB

    • MD5

      2c7a1fab26ce5f143044435c36e5b9f1

    • SHA1

      29d1e2eabde076cc61af1dda480a12d822a2077f

    • SHA256

      dc5e5c59ca1a27d049a056ec33c05ccb53cda43e264871999f717bde4ad1e74e

    • SHA512

      a6dca44b77dfe23de4f3ec5ab203af208824f364c7f0397c0ecd516cf0bc4d058f59dcfb124c2488385bfe15fce317c84b1ee6a110a6af0969fc678fbbfea215

    • SSDEEP

      12288:fMrly90SsKTkUruSd9x6UFvfObm3r8RdVPC78jfyOn39pkBfxCfHf8mn6xJtGrK:yy1stN9UFOQre0wb39hHUOgF

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks