General

  • Target

    efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e

  • Size

    673KB

  • Sample

    241110-dl778syblm

  • MD5

    9617634223a3f383437da9083935d580

  • SHA1

    c9efb1567fb3dcc157f6819fae7fb5174e4c644e

  • SHA256

    efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e

  • SHA512

    ea75630b8d153ef4ef37462dc96056be8e51689e2fde692ae54d67fd5f467899e0e08de9bdc12c030e6fd050a94b7921f9687fb0221ddc9de144c4005586151d

  • SSDEEP

    12288:GMrwy90WSHTKYUdomalIRA3mbIzzvzf2a7mULqD2JSlqDs6hAtE:6yKKYUdoX2ERX77mUGDkRRqu

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Targets

    • Target

      efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e

    • Size

      673KB

    • MD5

      9617634223a3f383437da9083935d580

    • SHA1

      c9efb1567fb3dcc157f6819fae7fb5174e4c644e

    • SHA256

      efcbd1af4190cb8f35b30fcfad852ae29b26194be807dd3c7e22c587788d383e

    • SHA512

      ea75630b8d153ef4ef37462dc96056be8e51689e2fde692ae54d67fd5f467899e0e08de9bdc12c030e6fd050a94b7921f9687fb0221ddc9de144c4005586151d

    • SSDEEP

      12288:GMrwy90WSHTKYUdomalIRA3mbIzzvzf2a7mULqD2JSlqDs6hAtE:6yKKYUdoX2ERX77mUGDkRRqu

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks