General

  • Target

    474b7237e7f158982d0a339c23d4f688d63b8480421cc94e21585a3deabeb080

  • Size

    694KB

  • Sample

    241121-3d5jtawrgl

  • MD5

    44cf2a9c3d92cea1bb61bca0c10a5a0c

  • SHA1

    61563fa3b854799550594d5d938e9d3158c54e27

  • SHA256

    474b7237e7f158982d0a339c23d4f688d63b8480421cc94e21585a3deabeb080

  • SHA512

    95d304c527b914dbd4dd6473c8cb6016ca8010f5c435320e3f115c8c06304764dc1505319c24cb06e90ad24021e87499e910a7c7586937e23c9b52defabd2d53

  • SSDEEP

    12288:oy90zkhSS7/rtHOixnuQFE8FEnX7eQ8k1H1sgIrQeklJrnNep4:oyCkhxTxzZHYX7zxIrbklZnX

Malware Config

Targets

    • Target

      474b7237e7f158982d0a339c23d4f688d63b8480421cc94e21585a3deabeb080

    • Size

      694KB

    • MD5

      44cf2a9c3d92cea1bb61bca0c10a5a0c

    • SHA1

      61563fa3b854799550594d5d938e9d3158c54e27

    • SHA256

      474b7237e7f158982d0a339c23d4f688d63b8480421cc94e21585a3deabeb080

    • SHA512

      95d304c527b914dbd4dd6473c8cb6016ca8010f5c435320e3f115c8c06304764dc1505319c24cb06e90ad24021e87499e910a7c7586937e23c9b52defabd2d53

    • SSDEEP

      12288:oy90zkhSS7/rtHOixnuQFE8FEnX7eQ8k1H1sgIrQeklJrnNep4:oyCkhxTxzZHYX7zxIrbklZnX

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks