General

  • Target

    5f241e86fc11d029b8855337be46725ff5e0eb647b33e00d2a361cf23ead4d4e.exe

  • Size

    546KB

  • Sample

    241113-ree5rsspat

  • MD5

    a454dadc24826cb8bb32f952c20bc517

  • SHA1

    119a02ee2ea99322e97bce2cc13255ab6ebb31e3

  • SHA256

    5f241e86fc11d029b8855337be46725ff5e0eb647b33e00d2a361cf23ead4d4e

  • SHA512

    24288f2bfb4e3cef0796fe24d77b01a5f523f7fc654c7e3c27499af3a7fa35e35d66a8c2987deb413dc8b494d472b620081ac0c69e330c7efcbb8ab892f086c9

  • SSDEEP

    12288:sMr3y90tv/BjxoNpvdZluSoTWrc0nIfk1gGg:DyUv/BivdZ8jirWfkTg

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Targets

    • Target

      5f241e86fc11d029b8855337be46725ff5e0eb647b33e00d2a361cf23ead4d4e.exe

    • Size

      546KB

    • MD5

      a454dadc24826cb8bb32f952c20bc517

    • SHA1

      119a02ee2ea99322e97bce2cc13255ab6ebb31e3

    • SHA256

      5f241e86fc11d029b8855337be46725ff5e0eb647b33e00d2a361cf23ead4d4e

    • SHA512

      24288f2bfb4e3cef0796fe24d77b01a5f523f7fc654c7e3c27499af3a7fa35e35d66a8c2987deb413dc8b494d472b620081ac0c69e330c7efcbb8ab892f086c9

    • SSDEEP

      12288:sMr3y90tv/BjxoNpvdZluSoTWrc0nIfk1gGg:DyUv/BivdZ8jirWfkTg

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks