General

  • Target

    9a74e739722e9f66f96e6310ab51d850fbaa1bb71aca886875707dda1a24b219

  • Size

    682KB

  • Sample

    241111-graqpstlds

  • MD5

    8ab8ef52ecf8ee794ceb8e8b83dd7e32

  • SHA1

    7bcbb719d8c6a49839f685ddbc10432f5bc2a5e0

  • SHA256

    9a74e739722e9f66f96e6310ab51d850fbaa1bb71aca886875707dda1a24b219

  • SHA512

    ebf4a1414bdccf48f1d7d71b6d9d2d4733137835819c6be0a9e367d52ce2a12ca71f6f1e047e9c60b55c2e36e7cf1801cc1535f517d32a112ea052190a58b0c4

  • SSDEEP

    12288:3Mrdy90bnGrUVU/EhznEN68fwiGPE49N+9I39bQgEt+uGMmzCuhhagW:KyqnG4VUsLKrz0E43u6vE8u3iNW

Malware Config

Extracted

Family

redline

Botnet

stek

C2

melevv.eu:4162

Attributes
  • auth_value

    4205381daf6946b2df5fe3bc7eacc918

Targets

    • Target

      9a74e739722e9f66f96e6310ab51d850fbaa1bb71aca886875707dda1a24b219

    • Size

      682KB

    • MD5

      8ab8ef52ecf8ee794ceb8e8b83dd7e32

    • SHA1

      7bcbb719d8c6a49839f685ddbc10432f5bc2a5e0

    • SHA256

      9a74e739722e9f66f96e6310ab51d850fbaa1bb71aca886875707dda1a24b219

    • SHA512

      ebf4a1414bdccf48f1d7d71b6d9d2d4733137835819c6be0a9e367d52ce2a12ca71f6f1e047e9c60b55c2e36e7cf1801cc1535f517d32a112ea052190a58b0c4

    • SSDEEP

      12288:3Mrdy90bnGrUVU/EhznEN68fwiGPE49N+9I39bQgEt+uGMmzCuhhagW:KyqnG4VUsLKrz0E43u6vE8u3iNW

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks