General

  • Target

    9b9bf5c19c528282e0c88ecc3b36e181b6d8f38b6f7a9f766dd37f1bdb64a7ed

  • Size

    689KB

  • Sample

    241111-hpf1davemn

  • MD5

    cbfde2223c428839f0b4c13e2fa5a109

  • SHA1

    d2713ab644c72d0394befdc1b11cb76dc0c63c7c

  • SHA256

    9b9bf5c19c528282e0c88ecc3b36e181b6d8f38b6f7a9f766dd37f1bdb64a7ed

  • SHA512

    3dee57201a7dbbea23cd5bd5b56c5c783e9af95586e6fb7bc5f58007686e92f873644127256efd5a3fcf46bd2e821d8b35136ce5e8c5875280d31bcbda748714

  • SSDEEP

    12288:EMrKy903+6TK78iqaZIpCkdzLngimYh1oID43xBYMOKbcxXolf+IAhQDHXps7:+yr4XU1kdzLn51fD4hiMTIx4QoHXps7

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Targets

    • Target

      9b9bf5c19c528282e0c88ecc3b36e181b6d8f38b6f7a9f766dd37f1bdb64a7ed

    • Size

      689KB

    • MD5

      cbfde2223c428839f0b4c13e2fa5a109

    • SHA1

      d2713ab644c72d0394befdc1b11cb76dc0c63c7c

    • SHA256

      9b9bf5c19c528282e0c88ecc3b36e181b6d8f38b6f7a9f766dd37f1bdb64a7ed

    • SHA512

      3dee57201a7dbbea23cd5bd5b56c5c783e9af95586e6fb7bc5f58007686e92f873644127256efd5a3fcf46bd2e821d8b35136ce5e8c5875280d31bcbda748714

    • SSDEEP

      12288:EMrKy903+6TK78iqaZIpCkdzLngimYh1oID43xBYMOKbcxXolf+IAhQDHXps7:+yr4XU1kdzLn51fD4hiMTIx4QoHXps7

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks