General

  • Target

    7c41e2c8e2a877a530ed4115bcae57075397c78f55b9ea85486d876e89ce0208N.exe

  • Size

    409KB

  • Sample

    241113-q16deawmhn

  • MD5

    6a83078232d0ffa8756b4519ffd0ea80

  • SHA1

    bd38862f57f693b601b6df0465dcec68539462f4

  • SHA256

    7c41e2c8e2a877a530ed4115bcae57075397c78f55b9ea85486d876e89ce0208

  • SHA512

    ae36d9d52646836c667b497c0c957725e709a6c50ba45f31e263bc9953a6ad33f7ce6de6b39cd820b1917cdd76a64d151a51d11b974d6e8889dd1b540e1faeec

  • SSDEEP

    6144:yFep0yN90QEdhY1dXuIT1rysMo+yS4Ji2HDBkMBGCeEh+KJz37yDF:My90vq1dXuIsShFH2MwCei+K96

Malware Config

Targets

    • Target

      7c41e2c8e2a877a530ed4115bcae57075397c78f55b9ea85486d876e89ce0208N.exe

    • Size

      409KB

    • MD5

      6a83078232d0ffa8756b4519ffd0ea80

    • SHA1

      bd38862f57f693b601b6df0465dcec68539462f4

    • SHA256

      7c41e2c8e2a877a530ed4115bcae57075397c78f55b9ea85486d876e89ce0208

    • SHA512

      ae36d9d52646836c667b497c0c957725e709a6c50ba45f31e263bc9953a6ad33f7ce6de6b39cd820b1917cdd76a64d151a51d11b974d6e8889dd1b540e1faeec

    • SSDEEP

      6144:yFep0yN90QEdhY1dXuIT1rysMo+yS4Ji2HDBkMBGCeEh+KJz37yDF:My90vq1dXuIsShFH2MwCei+K96

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks