General

  • Target

    0684e939179e4f8f6c3253007dee3938a265f24388a1cc5ed4964380cc8ad59b

  • Size

    404KB

  • Sample

    241112-x1yrwszakg

  • MD5

    8a6b81a5f2b8bfb1edaac36cddf9be7f

  • SHA1

    aaee253f201a419a7467cf9f148ff46d927d5cd4

  • SHA256

    0684e939179e4f8f6c3253007dee3938a265f24388a1cc5ed4964380cc8ad59b

  • SHA512

    d00df81f9be59b6059d3e578da917cc012c03dda9ffe04fb9ccd9603a90c5b3d74937ee146e109561bf3945418a33fb6b77be004491cb5d0bb63032ebe2c3f09

  • SSDEEP

    6144:KAy+bnr+0p0yN90QEtFoH9Af4M/3qbO7NPuEW8SWCJD0Lj7xZDl+LBB:kMrgy90JoH9LQKcstHwLnDgL

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Targets

    • Target

      0684e939179e4f8f6c3253007dee3938a265f24388a1cc5ed4964380cc8ad59b

    • Size

      404KB

    • MD5

      8a6b81a5f2b8bfb1edaac36cddf9be7f

    • SHA1

      aaee253f201a419a7467cf9f148ff46d927d5cd4

    • SHA256

      0684e939179e4f8f6c3253007dee3938a265f24388a1cc5ed4964380cc8ad59b

    • SHA512

      d00df81f9be59b6059d3e578da917cc012c03dda9ffe04fb9ccd9603a90c5b3d74937ee146e109561bf3945418a33fb6b77be004491cb5d0bb63032ebe2c3f09

    • SSDEEP

      6144:KAy+bnr+0p0yN90QEtFoH9Af4M/3qbO7NPuEW8SWCJD0Lj7xZDl+LBB:kMrgy90JoH9LQKcstHwLnDgL

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks