General

  • Target

    121d164d7aeecb6f7dbf0006002af62a267ab4f54899c31a5e6bd73448764a3e

  • Size

    706KB

  • Sample

    241111-gp1jcathmn

  • MD5

    0fb13d2adba06b51c087021d586524d9

  • SHA1

    dc1025757ac7640a1182c90557653a27b6a6f84e

  • SHA256

    121d164d7aeecb6f7dbf0006002af62a267ab4f54899c31a5e6bd73448764a3e

  • SHA512

    ba33fece6cbf343fb1b11468204817e9944e23bce1219c11ae53f8f329f9ef0b3b7c9a97e5aa9b19c06f3453ae881c31e5f603cc8772eb466179d65e90cecde9

  • SSDEEP

    12288:NMr9y90h9GO0JyHn3L8bHbRc2YZ60qrlob5JhzfijU65gh1WJ:0y6GO0JUnba7RbYZmWlz6jU7hi

Malware Config

Extracted

Family

redline

Botnet

ronam

C2

193.233.20.17:4139

Attributes
  • auth_value

    125421d19d14dd7fd211bc7f6d4aea6c

Targets

    • Target

      121d164d7aeecb6f7dbf0006002af62a267ab4f54899c31a5e6bd73448764a3e

    • Size

      706KB

    • MD5

      0fb13d2adba06b51c087021d586524d9

    • SHA1

      dc1025757ac7640a1182c90557653a27b6a6f84e

    • SHA256

      121d164d7aeecb6f7dbf0006002af62a267ab4f54899c31a5e6bd73448764a3e

    • SHA512

      ba33fece6cbf343fb1b11468204817e9944e23bce1219c11ae53f8f329f9ef0b3b7c9a97e5aa9b19c06f3453ae881c31e5f603cc8772eb466179d65e90cecde9

    • SSDEEP

      12288:NMr9y90h9GO0JyHn3L8bHbRc2YZ60qrlob5JhzfijU65gh1WJ:0y6GO0JUnba7RbYZmWlz6jU7hi

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks