General

  • Target

    bb47c52cafc0ccfe0041c60a1dbd111c0903abfc481bb272b7faaca7e133e7acN.exe

  • Size

    591KB

  • Sample

    241112-y4zn2a1amm

  • MD5

    63c7ce943a6eaf15adc24a07b0fbf5b0

  • SHA1

    b12aaa2090eb605b8f17f90fb3193c097bfbbf66

  • SHA256

    bb47c52cafc0ccfe0041c60a1dbd111c0903abfc481bb272b7faaca7e133e7ac

  • SHA512

    f4f1f4b8d8b1f6c76b35f9bc066d305d46ff84a50e2c5e86580cd8141c22af46e87e6e49944611ac81ba667f606c0118332f3a46b2215ce8be1aed3cbe299780

  • SSDEEP

    12288:Zy90zuBw4JAZ5llweLiOzoD1Gm9jnpu4n4Ry6JlU4ONPURXFZ:ZyquZM5bwXkQEmdnpus4oMoNPCXFZ

Malware Config

Targets

    • Target

      bb47c52cafc0ccfe0041c60a1dbd111c0903abfc481bb272b7faaca7e133e7acN.exe

    • Size

      591KB

    • MD5

      63c7ce943a6eaf15adc24a07b0fbf5b0

    • SHA1

      b12aaa2090eb605b8f17f90fb3193c097bfbbf66

    • SHA256

      bb47c52cafc0ccfe0041c60a1dbd111c0903abfc481bb272b7faaca7e133e7ac

    • SHA512

      f4f1f4b8d8b1f6c76b35f9bc066d305d46ff84a50e2c5e86580cd8141c22af46e87e6e49944611ac81ba667f606c0118332f3a46b2215ce8be1aed3cbe299780

    • SSDEEP

      12288:Zy90zuBw4JAZ5llweLiOzoD1Gm9jnpu4n4Ry6JlU4ONPURXFZ:ZyquZM5bwXkQEmdnpus4oMoNPCXFZ

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks