General

  • Target

    d73a55b8bf9db2961293511ffb3b53966aebf79f0121fbc92a5de0505315935c

  • Size

    403KB

  • Sample

    241117-lpdrssxbld

  • MD5

    875c56fda5f273cdbbe9827276f84955

  • SHA1

    dda92933d6a4b8256dcbb09a5798a5bbaf9e8f1e

  • SHA256

    d73a55b8bf9db2961293511ffb3b53966aebf79f0121fbc92a5de0505315935c

  • SHA512

    160a4e26b48743ea4b0bb143bec7ca1d2ea7c5e2c225861177763021043576fa2423ec546dbb2cb066322f86de5de036f83dc30ef300d93f057aafac88f069f5

  • SSDEEP

    6144:K2y+bnr+Ip0yN90QEXx2NBPL5cjl/9ADs6WVhgARjyO8aWZoxPqTfY:CMrQy90RINB92WDFWXpjyO8aWcPmY

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Targets

    • Target

      d73a55b8bf9db2961293511ffb3b53966aebf79f0121fbc92a5de0505315935c

    • Size

      403KB

    • MD5

      875c56fda5f273cdbbe9827276f84955

    • SHA1

      dda92933d6a4b8256dcbb09a5798a5bbaf9e8f1e

    • SHA256

      d73a55b8bf9db2961293511ffb3b53966aebf79f0121fbc92a5de0505315935c

    • SHA512

      160a4e26b48743ea4b0bb143bec7ca1d2ea7c5e2c225861177763021043576fa2423ec546dbb2cb066322f86de5de036f83dc30ef300d93f057aafac88f069f5

    • SSDEEP

      6144:K2y+bnr+Ip0yN90QEXx2NBPL5cjl/9ADs6WVhgARjyO8aWZoxPqTfY:CMrQy90RINB92WDFWXpjyO8aWcPmY

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks