General

  • Target

    b73f5ee5357df4ce2bc77a498a66204f379214983e62bc9e29d5e5b1ff5e8588

  • Size

    663KB

  • Sample

    241111-hjha9aykfj

  • MD5

    85450eba4ba5b88f70cecc400d7ef62f

  • SHA1

    c8943083fff540640eface6a88e2374496b62990

  • SHA256

    b73f5ee5357df4ce2bc77a498a66204f379214983e62bc9e29d5e5b1ff5e8588

  • SHA512

    86c8289d0dda65a46a80d562a445f38fca504c94a1374d726620dd9ca867b2928da533bad4a7cced042e5ab8c7f7556deb8822e2879bf8aba130d9f78e72a7b6

  • SSDEEP

    12288:jMrZy90q0ymiTLJKjFKdvkvu5VaWjihcq0gHaDKw2q3tm8d+Bm3yuA9aH:CyV0EaFKZbDPjihcq0xmw2q3E8ABmrsO

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Targets

    • Target

      b73f5ee5357df4ce2bc77a498a66204f379214983e62bc9e29d5e5b1ff5e8588

    • Size

      663KB

    • MD5

      85450eba4ba5b88f70cecc400d7ef62f

    • SHA1

      c8943083fff540640eface6a88e2374496b62990

    • SHA256

      b73f5ee5357df4ce2bc77a498a66204f379214983e62bc9e29d5e5b1ff5e8588

    • SHA512

      86c8289d0dda65a46a80d562a445f38fca504c94a1374d726620dd9ca867b2928da533bad4a7cced042e5ab8c7f7556deb8822e2879bf8aba130d9f78e72a7b6

    • SSDEEP

      12288:jMrZy90q0ymiTLJKjFKdvkvu5VaWjihcq0gHaDKw2q3tm8d+Bm3yuA9aH:CyV0EaFKZbDPjihcq0xmw2q3E8ABmrsO

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks