General

  • Target

    2cdb9cb28104dcdcc7752e1b5c505d86a577023cc9922ab48d4a33e9616d49fb

  • Size

    690KB

  • Sample

    241113-zls9zayfpg

  • MD5

    2e1b7f2a34dc859aafa3e1e06a5a05ca

  • SHA1

    285d3b1200c9308a44117ef2d0be2efbfc45a354

  • SHA256

    2cdb9cb28104dcdcc7752e1b5c505d86a577023cc9922ab48d4a33e9616d49fb

  • SHA512

    b5c7d4b00e5cb5d36f25c3cba1ed1f23b090c059bf09138323017aa2dc60d7299a3c403a64fa2c6afbb2e88e1ba1a9b1974bc059b6f0229049f8c308c7b7eda5

  • SSDEEP

    12288:fMrly905NRt8n1ZzTcnHx1hcDUIT6Fuk2KcBjbqpXRMGaD18tw2j:GyW81ZzmRPsNmFpfUSSx18n

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Targets

    • Target

      2cdb9cb28104dcdcc7752e1b5c505d86a577023cc9922ab48d4a33e9616d49fb

    • Size

      690KB

    • MD5

      2e1b7f2a34dc859aafa3e1e06a5a05ca

    • SHA1

      285d3b1200c9308a44117ef2d0be2efbfc45a354

    • SHA256

      2cdb9cb28104dcdcc7752e1b5c505d86a577023cc9922ab48d4a33e9616d49fb

    • SHA512

      b5c7d4b00e5cb5d36f25c3cba1ed1f23b090c059bf09138323017aa2dc60d7299a3c403a64fa2c6afbb2e88e1ba1a9b1974bc059b6f0229049f8c308c7b7eda5

    • SSDEEP

      12288:fMrly905NRt8n1ZzTcnHx1hcDUIT6Fuk2KcBjbqpXRMGaD18tw2j:GyW81ZzmRPsNmFpfUSSx18n

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks