Overview

overview

10

Static

static

3

1ff596d06b...98.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ff596d06ba6a0f5ed62f20edd7d3ae85339cfcec08ad668f6601254924a2498

  • Size

    553KB

  • Sample

    241121-y8awgaxjgz

  • MD5

    c981bb6cb9eff274acc6968bca7d94a8

  • SHA1

    c6c0867512afcf92c126772229d1d9c7132da7a0

  • SHA256

    1ff596d06ba6a0f5ed62f20edd7d3ae85339cfcec08ad668f6601254924a2498

  • SHA512

    00d4fd8708b6febb14c6d3ba46323535cd89189710dd29630785f5c2adc7571ac365782cf6b867fc99e3777ee9e37e2f481aeba70cfee32c1dd372610db8e024

  • SSDEEP

    12288:Uy90pPix46e+TI3jI+i3dxSXtbVncIBAXxKj:Uyqis+0p2e/n3Ae

Score
10/10
healerredlinediscoverydropperevasioninfostealerpersistencetrojan

Malware Config

Targets

    • Target

      1ff596d06ba6a0f5ed62f20edd7d3ae85339cfcec08ad668f6601254924a2498

    • Size

      553KB

    • MD5

      c981bb6cb9eff274acc6968bca7d94a8

    • SHA1

      c6c0867512afcf92c126772229d1d9c7132da7a0

    • SHA256

      1ff596d06ba6a0f5ed62f20edd7d3ae85339cfcec08ad668f6601254924a2498

    • SHA512

      00d4fd8708b6febb14c6d3ba46323535cd89189710dd29630785f5c2adc7571ac365782cf6b867fc99e3777ee9e37e2f481aeba70cfee32c1dd372610db8e024

    • SSDEEP

      12288:Uy90pPix46e+TI3jI+i3dxSXtbVncIBAXxKj:Uyqis+0p2e/n3Ae

    Score
    10/10
    healerredlinediscoverydropperevasioninfostealerpersistencetrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Healer family

      healer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks