General

  • Target

    c8fe710e404102628f3655d4860425aeeb3c211a0ae8e46d9a7896e90d0c0a4fN.exe

  • Size

    469KB

  • Sample

    241119-pvxzeawjgw

  • MD5

    a22b575aefa2963a490f362f7c214e50

  • SHA1

    cbb0a5ca0f46060e74a633486aa971d715786aa7

  • SHA256

    c8fe710e404102628f3655d4860425aeeb3c211a0ae8e46d9a7896e90d0c0a4f

  • SHA512

    fd01dfe37fc896a3538ecc9d7d8ed56a739d58a583f12bcb2aa3a45eb895bd0bce8d190502a1a1ef6da59f943455dd5a572d1575d3cabd17fb5925a7fc66c281

  • SSDEEP

    6144:gBp0yN90QEwyEPOJ0qjEPPprsYEacBh/qubUR5XvU/p9xVLIp7pfzMn:Ly906y9cx6BhiuaRc/p9x1

Malware Config

Targets

    • Target

      c8fe710e404102628f3655d4860425aeeb3c211a0ae8e46d9a7896e90d0c0a4fN.exe

    • Size

      469KB

    • MD5

      a22b575aefa2963a490f362f7c214e50

    • SHA1

      cbb0a5ca0f46060e74a633486aa971d715786aa7

    • SHA256

      c8fe710e404102628f3655d4860425aeeb3c211a0ae8e46d9a7896e90d0c0a4f

    • SHA512

      fd01dfe37fc896a3538ecc9d7d8ed56a739d58a583f12bcb2aa3a45eb895bd0bce8d190502a1a1ef6da59f943455dd5a572d1575d3cabd17fb5925a7fc66c281

    • SSDEEP

      6144:gBp0yN90QEwyEPOJ0qjEPPprsYEacBh/qubUR5XvU/p9xVLIp7pfzMn:Ly906y9cx6BhiuaRc/p9x1

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks