General

  • Target

    efe60fbf46c06f39c0505cbebcb2f56c048af217afb240c9dd6e6f0d1b09b4a9

  • Size

    536KB

  • Sample

    241110-d495js1rfl

  • MD5

    46dc16c188f7a950aa6bb18416287913

  • SHA1

    76b1f101aab0f0a13c1673f39f2fdec2ed7b37f1

  • SHA256

    efe60fbf46c06f39c0505cbebcb2f56c048af217afb240c9dd6e6f0d1b09b4a9

  • SHA512

    c71c6ccf7ef8a6b12ead4e899d054878185cf6ae0c6e9226871a8d10df5b4118738b557d55522cbae9eacf04ade3f07d3b478cf49f3a1583c8a5d1b4ced7c6ea

  • SSDEEP

    12288:RMrzy90y53t8QU138o/ABAtdYbLbFdxQw:GyN598QU138iABAzYzzxQw

Malware Config

Extracted

Family

redline

Botnet

rouch

C2

193.56.146.11:4162

Attributes
  • auth_value

    1b1735bcfc122c708eae27ca352568de

Targets

    • Target

      efe60fbf46c06f39c0505cbebcb2f56c048af217afb240c9dd6e6f0d1b09b4a9

    • Size

      536KB

    • MD5

      46dc16c188f7a950aa6bb18416287913

    • SHA1

      76b1f101aab0f0a13c1673f39f2fdec2ed7b37f1

    • SHA256

      efe60fbf46c06f39c0505cbebcb2f56c048af217afb240c9dd6e6f0d1b09b4a9

    • SHA512

      c71c6ccf7ef8a6b12ead4e899d054878185cf6ae0c6e9226871a8d10df5b4118738b557d55522cbae9eacf04ade3f07d3b478cf49f3a1583c8a5d1b4ced7c6ea

    • SSDEEP

      12288:RMrzy90y53t8QU138o/ABAtdYbLbFdxQw:GyN598QU138iABAzYzzxQw

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks