General

  • Target

    f5af6bec93e7764210bd1a241ef12e5f278fb86b323ca4a45f49cc1702070188N.exe

  • Size

    540KB

  • Sample

    241113-zxq9rayhlc

  • MD5

    fbeb70a100c2ee1da8002230f04e3870

  • SHA1

    4c89394ae0ab37ba465a401f1f1bb4ac3c0bcf50

  • SHA256

    f5af6bec93e7764210bd1a241ef12e5f278fb86b323ca4a45f49cc1702070188

  • SHA512

    597a51c3ce6205dd15559d2e5feb6ef8a081623ee7c351277610441c4087bf4007c702e8de29760a1e10d03e2ca0107ec37b4644f38d0c4c92e9c6564fa41a32

  • SSDEEP

    6144:O6p0yN90QEsx1Fjm9LkxWZFiRx39rgJhLneIXWMN3qNMf5NB3YQvDPPpciBEfTga:ay90SFmteWZOvNgfB3FvLpciB4Tgna

Malware Config

Targets

    • Target

      f5af6bec93e7764210bd1a241ef12e5f278fb86b323ca4a45f49cc1702070188N.exe

    • Size

      540KB

    • MD5

      fbeb70a100c2ee1da8002230f04e3870

    • SHA1

      4c89394ae0ab37ba465a401f1f1bb4ac3c0bcf50

    • SHA256

      f5af6bec93e7764210bd1a241ef12e5f278fb86b323ca4a45f49cc1702070188

    • SHA512

      597a51c3ce6205dd15559d2e5feb6ef8a081623ee7c351277610441c4087bf4007c702e8de29760a1e10d03e2ca0107ec37b4644f38d0c4c92e9c6564fa41a32

    • SSDEEP

      6144:O6p0yN90QEsx1Fjm9LkxWZFiRx39rgJhLneIXWMN3qNMf5NB3YQvDPPpciBEfTga:ay90SFmteWZOvNgfB3FvLpciB4Tgna

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks