General

  • Target

    40a24f0d0e71d3401cc405f6261a37d235d4b974a5ebc328e87c694c9a3a2318

  • Size

    480KB

  • Sample

    241110-ejqe3szarc

  • MD5

    9a267a888fc330c3af53e920fe03881c

  • SHA1

    8a6ff330a2463337dbc7132fcb999c849e70b282

  • SHA256

    40a24f0d0e71d3401cc405f6261a37d235d4b974a5ebc328e87c694c9a3a2318

  • SHA512

    8bb07308de30531a927560427ba03794bcd5bd71f8df83947ced1e8b90910744cd451f6d70a120cd8184f96d5e67344008401a011a37399d84b578204ff7e329

  • SSDEEP

    12288:mMr1y902mD/roi5c1u31UTfr73NQ2+yEwrA8+UmaK:3ytmwmXGTDO23bl+UmV

Malware Config

Extracted

Family

redline

Botnet

domor

C2

217.196.96.101:4132

Attributes
  • auth_value

    39471bda00546bb0435bc7adfd6881dc

Targets

    • Target

      40a24f0d0e71d3401cc405f6261a37d235d4b974a5ebc328e87c694c9a3a2318

    • Size

      480KB

    • MD5

      9a267a888fc330c3af53e920fe03881c

    • SHA1

      8a6ff330a2463337dbc7132fcb999c849e70b282

    • SHA256

      40a24f0d0e71d3401cc405f6261a37d235d4b974a5ebc328e87c694c9a3a2318

    • SHA512

      8bb07308de30531a927560427ba03794bcd5bd71f8df83947ced1e8b90910744cd451f6d70a120cd8184f96d5e67344008401a011a37399d84b578204ff7e329

    • SSDEEP

      12288:mMr1y902mD/roi5c1u31UTfr73NQ2+yEwrA8+UmaK:3ytmwmXGTDO23bl+UmV

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks