General

  • Target

    d1c87259d8611552bfcad0b0de13a0d3778b55948d70786cdc818f2b4e1da612N

  • Size

    391KB

  • Sample

    241113-y1gn2sydkc

  • MD5

    d4fc2582d2215c1f86cfd80e0263bab0

  • SHA1

    d877f78cb5461cbf4f4f2d30300f10d8174cee55

  • SHA256

    d1c87259d8611552bfcad0b0de13a0d3778b55948d70786cdc818f2b4e1da612

  • SHA512

    5a4937d5a2568da4ebbeaf0286130e3bab37584c9cd4112e81d3e64048b3170c09cebf0e57adf9f9d8c9fcccf9530a4bcff5486bc2c64d88e6f64ab145f0822f

  • SSDEEP

    6144:Kty+bnr+jp0yN90QEcplgwSI8tYD1LjDXjqm7lA11Qh:PMrzy90QSI8G9j5eQh

Malware Config

Extracted

Family

redline

Botnet

rumfa

C2

193.233.20.24:4123

Attributes
  • auth_value

    749d02a6b4ef1fa2ad908e44ec2296dc

Targets

    • Target

      d1c87259d8611552bfcad0b0de13a0d3778b55948d70786cdc818f2b4e1da612N

    • Size

      391KB

    • MD5

      d4fc2582d2215c1f86cfd80e0263bab0

    • SHA1

      d877f78cb5461cbf4f4f2d30300f10d8174cee55

    • SHA256

      d1c87259d8611552bfcad0b0de13a0d3778b55948d70786cdc818f2b4e1da612

    • SHA512

      5a4937d5a2568da4ebbeaf0286130e3bab37584c9cd4112e81d3e64048b3170c09cebf0e57adf9f9d8c9fcccf9530a4bcff5486bc2c64d88e6f64ab145f0822f

    • SSDEEP

      6144:Kty+bnr+jp0yN90QEcplgwSI8tYD1LjDXjqm7lA11Qh:PMrzy90QSI8G9j5eQh

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks