General

  • Target

    f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9

  • Size

    746KB

  • Sample

    241111-gq48xsxpgn

  • MD5

    96a6c4b28d349a3b379f052bbb2d8c6f

  • SHA1

    23cc31f23de3db9855236c1dfe6bb33abb90c01e

  • SHA256

    f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9

  • SHA512

    6b742fdce7def85aba7efd2e0388d94b1e0563c88eb98db5cc615f57ae3a7baa29364b9441374588aecf8dc5e00e483f89f72a54b92f07bbfe3ab937f240db75

  • SSDEEP

    12288:ky90g1iePbG47mLI0cRcfaSzJEJNuN6Mt7xNTF9kFWhZob44wnN5mU32T9z:kygePC4icCySzUMtz9auKb4ZnNQd5z

Malware Config

Targets

    • Target

      f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9

    • Size

      746KB

    • MD5

      96a6c4b28d349a3b379f052bbb2d8c6f

    • SHA1

      23cc31f23de3db9855236c1dfe6bb33abb90c01e

    • SHA256

      f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9

    • SHA512

      6b742fdce7def85aba7efd2e0388d94b1e0563c88eb98db5cc615f57ae3a7baa29364b9441374588aecf8dc5e00e483f89f72a54b92f07bbfe3ab937f240db75

    • SSDEEP

      12288:ky90g1iePbG47mLI0cRcfaSzJEJNuN6Mt7xNTF9kFWhZob44wnN5mU32T9z:kygePC4icCySzUMtz9auKb4ZnNQd5z

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks