General

  • Target

    e5904b9f9a74908442cf428e4a8c4f66359a984d44c7ad6ebdb4fb22a27ccc0c

  • Size

    689KB

  • Sample

    241111-gm124axpbn

  • MD5

    ca4fafa48f64ff208b0f8d82861dd3f9

  • SHA1

    fe7fe63037b4a59f925f4b8041436c75abfd82a0

  • SHA256

    e5904b9f9a74908442cf428e4a8c4f66359a984d44c7ad6ebdb4fb22a27ccc0c

  • SHA512

    db58644fe0a15da1221d97404c4a5b63bab52203a6895d0892bad099744ed0e0c44f1f598cfca0d1781a279e60a40e93b2dca45829f97587f90b827b9fb562c3

  • SSDEEP

    12288:tMray9056S/AiGoAPRIk1Vmhw9jfB43xBYMJKb51a59+nGI81:XyNgwP/mhw9V4hiM4LvZu

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Targets

    • Target

      e5904b9f9a74908442cf428e4a8c4f66359a984d44c7ad6ebdb4fb22a27ccc0c

    • Size

      689KB

    • MD5

      ca4fafa48f64ff208b0f8d82861dd3f9

    • SHA1

      fe7fe63037b4a59f925f4b8041436c75abfd82a0

    • SHA256

      e5904b9f9a74908442cf428e4a8c4f66359a984d44c7ad6ebdb4fb22a27ccc0c

    • SHA512

      db58644fe0a15da1221d97404c4a5b63bab52203a6895d0892bad099744ed0e0c44f1f598cfca0d1781a279e60a40e93b2dca45829f97587f90b827b9fb562c3

    • SSDEEP

      12288:tMray9056S/AiGoAPRIk1Vmhw9jfB43xBYMJKb51a59+nGI81:XyNgwP/mhw9V4hiM4LvZu

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks