General

  • Target

    3e77d7f90772ccfcd4f5b981d1fefb2f83c5e3755e471805ed0aeb4d4151e913

  • Size

    860KB

  • Sample

    241111-m4zs9aycrl

  • MD5

    0ef71e11214e56068849940f731053ce

  • SHA1

    0ecf2c9d13459baed7cff2360d05687800e63a85

  • SHA256

    3e77d7f90772ccfcd4f5b981d1fefb2f83c5e3755e471805ed0aeb4d4151e913

  • SHA512

    2a2d2fbda99275de4bff09732aea28d842fd87eca209aa14ccfecc28497a512e785ffffdce7d7d98a7bcf3fa43f90867a79edabba3dd04a4536edd7b3f02cd23

  • SSDEEP

    24576:Ky1fV2/j1nwYEwgaID4EWg4iTqP3wlGrh2SgX2YkI:R1fAREJPWgPuP3wGgX

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Targets

    • Target

      3e77d7f90772ccfcd4f5b981d1fefb2f83c5e3755e471805ed0aeb4d4151e913

    • Size

      860KB

    • MD5

      0ef71e11214e56068849940f731053ce

    • SHA1

      0ecf2c9d13459baed7cff2360d05687800e63a85

    • SHA256

      3e77d7f90772ccfcd4f5b981d1fefb2f83c5e3755e471805ed0aeb4d4151e913

    • SHA512

      2a2d2fbda99275de4bff09732aea28d842fd87eca209aa14ccfecc28497a512e785ffffdce7d7d98a7bcf3fa43f90867a79edabba3dd04a4536edd7b3f02cd23

    • SSDEEP

      24576:Ky1fV2/j1nwYEwgaID4EWg4iTqP3wlGrh2SgX2YkI:R1fAREJPWgPuP3wGgX

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks