General

  • Target

    0efa3556f425a4f1664f514f159209d4b6a3aea6c8dc99eb30864d8fdd9ecd14

  • Size

    457KB

  • Sample

    241113-yem9psycpr

  • MD5

    9450ea28c4ff115262b1e13bae7b4732

  • SHA1

    50fe124d3227adaa5cc6b072f24053067703021e

  • SHA256

    0efa3556f425a4f1664f514f159209d4b6a3aea6c8dc99eb30864d8fdd9ecd14

  • SHA512

    89653e6e8f49e8ab74cb3168e7562a0a98f7557efe27584b32e770f262b40dbdf54579ae700a2021ec772179049b3d434003bdd25217f9723eb95cebeeb85c6f

  • SSDEEP

    6144:QHp0yN90QEpm3Y648EOE9WgVB0DUapXT1ukRGqmm3/qx9vklrmApWKFk:Ry90VfOE9hBUJTRmAY2pWK2

Malware Config

Targets

    • Target

      0efa3556f425a4f1664f514f159209d4b6a3aea6c8dc99eb30864d8fdd9ecd14

    • Size

      457KB

    • MD5

      9450ea28c4ff115262b1e13bae7b4732

    • SHA1

      50fe124d3227adaa5cc6b072f24053067703021e

    • SHA256

      0efa3556f425a4f1664f514f159209d4b6a3aea6c8dc99eb30864d8fdd9ecd14

    • SHA512

      89653e6e8f49e8ab74cb3168e7562a0a98f7557efe27584b32e770f262b40dbdf54579ae700a2021ec772179049b3d434003bdd25217f9723eb95cebeeb85c6f

    • SSDEEP

      6144:QHp0yN90QEpm3Y648EOE9WgVB0DUapXT1ukRGqmm3/qx9vklrmApWKFk:Ry90VfOE9hBUJTRmAY2pWK2

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks