General

  • Target

    149ce5384b2401e9eccb8d8bf8556b044d4341361aa31b8dbeab382ce3960214

  • Size

    532KB

  • Sample

    241111-gmjg2svcke

  • MD5

    e160f56355b32623c401ac4512d95671

  • SHA1

    068285d91df8e661e147397ceceb1c8beee976c8

  • SHA256

    149ce5384b2401e9eccb8d8bf8556b044d4341361aa31b8dbeab382ce3960214

  • SHA512

    220f4889556b6aeb4803d031f32bc5cb620a88d5e671130f424e2f8be07db20c977fd92818e0acaf70580d9febbc7dc1c1686a04a9c598ede76df681e13c8c17

  • SSDEEP

    12288:0MrTy90XeVtgKW4bUGFYWRzDbABx3osHXG5WEN5QwPpp1D:/ywY24bPJHbAb4s3GHnQ8pJ

Malware Config

Extracted

Family

redline

Botnet

rulit

C2

pedigj.eu:4162

Attributes
  • auth_value

    f4df9ef56871d4ac883b282abaf635e0

Targets

    • Target

      149ce5384b2401e9eccb8d8bf8556b044d4341361aa31b8dbeab382ce3960214

    • Size

      532KB

    • MD5

      e160f56355b32623c401ac4512d95671

    • SHA1

      068285d91df8e661e147397ceceb1c8beee976c8

    • SHA256

      149ce5384b2401e9eccb8d8bf8556b044d4341361aa31b8dbeab382ce3960214

    • SHA512

      220f4889556b6aeb4803d031f32bc5cb620a88d5e671130f424e2f8be07db20c977fd92818e0acaf70580d9febbc7dc1c1686a04a9c598ede76df681e13c8c17

    • SSDEEP

      12288:0MrTy90XeVtgKW4bUGFYWRzDbABx3osHXG5WEN5QwPpp1D:/ywY24bPJHbAb4s3GHnQ8pJ

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks