General

  • Target

    3b9214ce9399ccd690d07e17a279eb4a9fe1a4ff1f8565dff13fab8b73fcf705

  • Size

    936KB

  • Sample

    241111-ggk4pavbnb

  • MD5

    99e9d5d60a305fc45aa8b9e8670961b6

  • SHA1

    7e9fba48fc43331f775fe4c9f0e8c6bbb3b37e11

  • SHA256

    3b9214ce9399ccd690d07e17a279eb4a9fe1a4ff1f8565dff13fab8b73fcf705

  • SHA512

    912ef0707a03b13954fbe0d05322493913d8af3c2576a4d620c771c4f24edded901a549521ba47720989b771eb212a7cd147d3df4ccdea54de27db46caf3345c

  • SSDEEP

    24576:VyilVHMGLDg12rXMioCPnz87WPfg6cuFy8YdF:wilVHMGL8TibPz87WPf+/8

Malware Config

Targets

    • Target

      3b9214ce9399ccd690d07e17a279eb4a9fe1a4ff1f8565dff13fab8b73fcf705

    • Size

      936KB

    • MD5

      99e9d5d60a305fc45aa8b9e8670961b6

    • SHA1

      7e9fba48fc43331f775fe4c9f0e8c6bbb3b37e11

    • SHA256

      3b9214ce9399ccd690d07e17a279eb4a9fe1a4ff1f8565dff13fab8b73fcf705

    • SHA512

      912ef0707a03b13954fbe0d05322493913d8af3c2576a4d620c771c4f24edded901a549521ba47720989b771eb212a7cd147d3df4ccdea54de27db46caf3345c

    • SSDEEP

      24576:VyilVHMGLDg12rXMioCPnz87WPfg6cuFy8YdF:wilVHMGL8TibPz87WPf+/8

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks