General

  • Target

    e80711882afffcc75b1c073d4536dff347682d302da29829849bece6d1502bb3

  • Size

    522KB

  • Sample

    241110-d659dasjan

  • MD5

    f253623574838631e374478a80299e4c

  • SHA1

    cb7cdfedaf2f7c695ca49ab6accc8f38a25b8ce7

  • SHA256

    e80711882afffcc75b1c073d4536dff347682d302da29829849bece6d1502bb3

  • SHA512

    34097413c718e131b98c09f5d340670223659c6c57a85cd16a8727b34bfea4d63169c07be676b478652190015b56bc0ddf7216c321237c6d27fbdbd314f7c86d

  • SSDEEP

    12288:hMrgy905euAlWzFoks+UbrwOdhCJJ6G5BRZcaQRN+y0m:Zyzu2WBG+UbxdYJgERZcXAu

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Targets

    • Target

      e80711882afffcc75b1c073d4536dff347682d302da29829849bece6d1502bb3

    • Size

      522KB

    • MD5

      f253623574838631e374478a80299e4c

    • SHA1

      cb7cdfedaf2f7c695ca49ab6accc8f38a25b8ce7

    • SHA256

      e80711882afffcc75b1c073d4536dff347682d302da29829849bece6d1502bb3

    • SHA512

      34097413c718e131b98c09f5d340670223659c6c57a85cd16a8727b34bfea4d63169c07be676b478652190015b56bc0ddf7216c321237c6d27fbdbd314f7c86d

    • SSDEEP

      12288:hMrgy905euAlWzFoks+UbrwOdhCJJ6G5BRZcaQRN+y0m:Zyzu2WBG+UbxdYJgERZcXAu

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks