General

  • Target

    647b3bb9a41376c8e144ab7550a2d9fdf3617613ce38945fafebc4c4843b53a4

  • Size

    480KB

  • Sample

    241110-eh3n1sygrm

  • MD5

    3edebf950bdd84012396a1e103076113

  • SHA1

    cd05a359d1b4e8889d0fec09651f2b9814726ed3

  • SHA256

    647b3bb9a41376c8e144ab7550a2d9fdf3617613ce38945fafebc4c4843b53a4

  • SHA512

    9b5645b2b670949e2e2be678833494c9f4b4c0ffe3b92f24c51dbcabbb019b908e0357e6f5cec3b9916d451f1f72ac1ddc34aa003504fac7c000b95236af5a9c

  • SSDEEP

    12288:QMrqy90rZHGvlEF/f2kGXw4b+jTWprbuL2xntm:qyk11/fr4b+vWB1fm

Malware Config

Extracted

Family

redline

Botnet

dease

C2

217.196.96.101:4132

Attributes
  • auth_value

    82e4d5f9abc21848e0345118814a4e6c

Targets

    • Target

      647b3bb9a41376c8e144ab7550a2d9fdf3617613ce38945fafebc4c4843b53a4

    • Size

      480KB

    • MD5

      3edebf950bdd84012396a1e103076113

    • SHA1

      cd05a359d1b4e8889d0fec09651f2b9814726ed3

    • SHA256

      647b3bb9a41376c8e144ab7550a2d9fdf3617613ce38945fafebc4c4843b53a4

    • SHA512

      9b5645b2b670949e2e2be678833494c9f4b4c0ffe3b92f24c51dbcabbb019b908e0357e6f5cec3b9916d451f1f72ac1ddc34aa003504fac7c000b95236af5a9c

    • SSDEEP

      12288:QMrqy90rZHGvlEF/f2kGXw4b+jTWprbuL2xntm:qyk11/fr4b+vWB1fm

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks