General

  • Target

    cfa5aaf9cd6b49f3de97bd3f5a97a21d33b1fd0c89f06a3c63c62112d626de6f

  • Size

    696KB

  • Sample

    241111-btyyesymfy

  • MD5

    e288231352766ba55eb8e2517a0a773b

  • SHA1

    6f0346fdd7cb930992b2531d7f33d7de54fc5813

  • SHA256

    cfa5aaf9cd6b49f3de97bd3f5a97a21d33b1fd0c89f06a3c63c62112d626de6f

  • SHA512

    7dffa0d7756e86bc4a8c6bb106306df2c29d3702f7a0de99794bec18fefdc22451993d5d80d1e3336cc1eb9bc431eb94a79d944608e1e98c83fb7dc0071d7428

  • SSDEEP

    12288:AMrry90VOSFgR63R9Ei+pGTVXhXuuleu/vtKLz3sWtnhATQs6cIjn0NUo:7yXW/Ei+peXhXuulR/vtyT1hATQshi0t

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Targets

    • Target

      cfa5aaf9cd6b49f3de97bd3f5a97a21d33b1fd0c89f06a3c63c62112d626de6f

    • Size

      696KB

    • MD5

      e288231352766ba55eb8e2517a0a773b

    • SHA1

      6f0346fdd7cb930992b2531d7f33d7de54fc5813

    • SHA256

      cfa5aaf9cd6b49f3de97bd3f5a97a21d33b1fd0c89f06a3c63c62112d626de6f

    • SHA512

      7dffa0d7756e86bc4a8c6bb106306df2c29d3702f7a0de99794bec18fefdc22451993d5d80d1e3336cc1eb9bc431eb94a79d944608e1e98c83fb7dc0071d7428

    • SSDEEP

      12288:AMrry90VOSFgR63R9Ei+pGTVXhXuuleu/vtKLz3sWtnhATQs6cIjn0NUo:7yXW/Ei+peXhXuulR/vtyT1hATQshi0t

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks