General

  • Target

    4c3a6bf7a8d73ae7ab917981093606a27dbce2db29e3e73a805e98be2918604f

  • Size

    689KB

  • Sample

    241111-gg1jdatkcz

  • MD5

    ee0e424d96f4019cfe7c4f00cd545537

  • SHA1

    87ca8d702cc383a2f7eb85acd34671b7673f8a3d

  • SHA256

    4c3a6bf7a8d73ae7ab917981093606a27dbce2db29e3e73a805e98be2918604f

  • SHA512

    2a59b2eabef18c5776605593c0ab8eff6bec663737c1b3892e5e6ed197c70926c1ae0d6cde79589cf0be72d64bd3ec53c763ae76f43991f1c1e609db4c837d96

  • SSDEEP

    12288:GMr9y90k+Q8P4LOfjnAd4Qx/8G3ZF30lRifWyD06FodEUxDs6d:/y64ujAqQ2GL3iE10aodEUxom

Malware Config

Extracted

Family

redline

Botnet

lint

C2

193.233.20.28:4125

Attributes
  • auth_value

    0e95262fb78243c67430f3148303e5b7

Targets

    • Target

      4c3a6bf7a8d73ae7ab917981093606a27dbce2db29e3e73a805e98be2918604f

    • Size

      689KB

    • MD5

      ee0e424d96f4019cfe7c4f00cd545537

    • SHA1

      87ca8d702cc383a2f7eb85acd34671b7673f8a3d

    • SHA256

      4c3a6bf7a8d73ae7ab917981093606a27dbce2db29e3e73a805e98be2918604f

    • SHA512

      2a59b2eabef18c5776605593c0ab8eff6bec663737c1b3892e5e6ed197c70926c1ae0d6cde79589cf0be72d64bd3ec53c763ae76f43991f1c1e609db4c837d96

    • SSDEEP

      12288:GMr9y90k+Q8P4LOfjnAd4Qx/8G3ZF30lRifWyD06FodEUxDs6d:/y64ujAqQ2GL3iE10aodEUxom

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks