General

  • Target

    cca0bb3d7055570fe986235b309462a3bd32f82f0e6ac6189ef7362dbbd2e4cf

  • Size

    478KB

  • Sample

    241111-gtzgvatlgz

  • MD5

    eda53fb2868c6d2c0ba4c5a25725a3bc

  • SHA1

    fea1f959259481e18e69ae65252f59be547f7e98

  • SHA256

    cca0bb3d7055570fe986235b309462a3bd32f82f0e6ac6189ef7362dbbd2e4cf

  • SHA512

    2c4931730d67ab40003692a198ce1ba6f1967a659df975a3b4533a74a4bea44aa5c5bf26e29ad65bb507b8919ab73c7ac577bc78e8311206178e6f8421f145e6

  • SSDEEP

    12288:bMrhy90lJCT93fhnAvX5c1u31sTZupol723qa2EL+NJVXl:2yaa3fFeJXmTkZ3q4L0V1

Malware Config

Extracted

Family

redline

Botnet

morty

C2

217.196.96.101:4132

Attributes
  • auth_value

    fe1a24c211cc8e5bf9ff11c737ce0e97

Targets

    • Target

      cca0bb3d7055570fe986235b309462a3bd32f82f0e6ac6189ef7362dbbd2e4cf

    • Size

      478KB

    • MD5

      eda53fb2868c6d2c0ba4c5a25725a3bc

    • SHA1

      fea1f959259481e18e69ae65252f59be547f7e98

    • SHA256

      cca0bb3d7055570fe986235b309462a3bd32f82f0e6ac6189ef7362dbbd2e4cf

    • SHA512

      2c4931730d67ab40003692a198ce1ba6f1967a659df975a3b4533a74a4bea44aa5c5bf26e29ad65bb507b8919ab73c7ac577bc78e8311206178e6f8421f145e6

    • SSDEEP

      12288:bMrhy90lJCT93fhnAvX5c1u31sTZupol723qa2EL+NJVXl:2yaa3fFeJXmTkZ3q4L0V1

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks