General

  • Target

    0d530e83ba120b222f621d84e0f35f7ac23f8d662ecf029bd21234dafb072bbb

  • Size

    1.0MB

  • Sample

    241111-ghnwzatgml

  • MD5

    e7c72f66ad2ad7a7ec8d32173bb8f0ce

  • SHA1

    1840b1442e94ae9443559cbcf59d0628c19481c9

  • SHA256

    0d530e83ba120b222f621d84e0f35f7ac23f8d662ecf029bd21234dafb072bbb

  • SHA512

    9f4597b7d64b9eafac27963d71e00b000073fb2b97fc151a829123ea4c18d3a7e862cf43a76fd636a0e23ee342692fbf52fa50669e8ee7686bd5175a1d44a677

  • SSDEEP

    24576:7qw0OA/oz/04YtRHw/tOWaqbkCimjVkaHtSv8I+h:N0Obw4Yt6OQlimjV3tSvc

Malware Config

Targets

    • Target

      0d530e83ba120b222f621d84e0f35f7ac23f8d662ecf029bd21234dafb072bbb

    • Size

      1.0MB

    • MD5

      e7c72f66ad2ad7a7ec8d32173bb8f0ce

    • SHA1

      1840b1442e94ae9443559cbcf59d0628c19481c9

    • SHA256

      0d530e83ba120b222f621d84e0f35f7ac23f8d662ecf029bd21234dafb072bbb

    • SHA512

      9f4597b7d64b9eafac27963d71e00b000073fb2b97fc151a829123ea4c18d3a7e862cf43a76fd636a0e23ee342692fbf52fa50669e8ee7686bd5175a1d44a677

    • SSDEEP

      24576:7qw0OA/oz/04YtRHw/tOWaqbkCimjVkaHtSv8I+h:N0Obw4Yt6OQlimjV3tSvc

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks