General

  • Target

    da3211a45ff2b4f741cb8b1d31555cd38386956b784800d1c2963e83e69dd4ebN

  • Size

    404KB

  • Sample

    241110-dmqpksybml

  • MD5

    da7b4460a2eba62dae2bfe540231b190

  • SHA1

    1daedf4119cc27334f16b5cdb50ab76479cd60b5

  • SHA256

    da3211a45ff2b4f741cb8b1d31555cd38386956b784800d1c2963e83e69dd4eb

  • SHA512

    4a66d5d0ec1624299b45f34423dc4e4ec1a9fdaec9dc88f90473f20c32830a4daf9410976cc86e642871d90ddd593196c005a134f90e2b664e23f5900d576695

  • SSDEEP

    6144:l+p0yN90QE1vzHA6iqNwMPWWpzenIIgaSO0DT0aixJB15N9OGQ6rxw:ly90Hvz8wplITQDT0aixJBzVdw

Malware Config

Targets

    • Target

      da3211a45ff2b4f741cb8b1d31555cd38386956b784800d1c2963e83e69dd4ebN

    • Size

      404KB

    • MD5

      da7b4460a2eba62dae2bfe540231b190

    • SHA1

      1daedf4119cc27334f16b5cdb50ab76479cd60b5

    • SHA256

      da3211a45ff2b4f741cb8b1d31555cd38386956b784800d1c2963e83e69dd4eb

    • SHA512

      4a66d5d0ec1624299b45f34423dc4e4ec1a9fdaec9dc88f90473f20c32830a4daf9410976cc86e642871d90ddd593196c005a134f90e2b664e23f5900d576695

    • SSDEEP

      6144:l+p0yN90QE1vzHA6iqNwMPWWpzenIIgaSO0DT0aixJB15N9OGQ6rxw:ly90Hvz8wplITQDT0aixJBzVdw

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks