General

  • Target

    ef62f527e6e06b518b384db105fe879e45d85da54e405a3468c8d35d15a08cdd

  • Size

    480KB

  • Sample

    241111-he6haaykbj

  • MD5

    8f092d674ac8186e6728965cf0bf26b9

  • SHA1

    776ed2a14609f1c90988a0194d601b2d56a3ad61

  • SHA256

    ef62f527e6e06b518b384db105fe879e45d85da54e405a3468c8d35d15a08cdd

  • SHA512

    bb8edf5f4ded68274637197e7fb6e313ca23fb69610d5df48aa2375730eef589bf0901c5514832824b6204e18084ed93d8803287eca4be9dc10bbf49d2cf76ae

  • SSDEEP

    6144:KVy+bnr+1p0yN90QE4h32N9r+vQkoQ3Ny8nV05FiHSIIXNXI+Tgza7ChITkQd/L:vMrFy90mh32fSLj9vV0gzYN7cWuRaT

Malware Config

Extracted

Family

redline

Botnet

misfa

C2

217.196.96.101:4132

Attributes
  • auth_value

    be2e6d9f1a5e54a81340947b20e561c1

Targets

    • Target

      ef62f527e6e06b518b384db105fe879e45d85da54e405a3468c8d35d15a08cdd

    • Size

      480KB

    • MD5

      8f092d674ac8186e6728965cf0bf26b9

    • SHA1

      776ed2a14609f1c90988a0194d601b2d56a3ad61

    • SHA256

      ef62f527e6e06b518b384db105fe879e45d85da54e405a3468c8d35d15a08cdd

    • SHA512

      bb8edf5f4ded68274637197e7fb6e313ca23fb69610d5df48aa2375730eef589bf0901c5514832824b6204e18084ed93d8803287eca4be9dc10bbf49d2cf76ae

    • SSDEEP

      6144:KVy+bnr+1p0yN90QE4h32N9r+vQkoQ3Ny8nV05FiHSIIXNXI+Tgza7ChITkQd/L:vMrFy90mh32fSLj9vV0gzYN7cWuRaT

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks