Extracted

Extracted

• • Target

    941230ca1fb838e3551244e36e23b0d69eedcf6641bcad167f54a3a5a4152226

  • Size

    650KB

  • MD5

    b53442b3f6b21aad6ae4e80a25ffbee1

  • SHA1

    5ab632a8dfb6bd9c08a21bce0722b2f8d6ecac2d

  • SHA256

    941230ca1fb838e3551244e36e23b0d69eedcf6641bcad167f54a3a5a4152226

  • SHA512

    e9d8f6d9eb0666456b9b6d4854fdc4afe2b2e1e84d32aaf81e0d52f793ba595d4f30a7764f0a6edbd98a55bde4444d8712782e191591265a2790d94687df641e

  • SSDEEP

    12288:RMrly90NXA3DVJ6zXNczgvJ+b+7Kg7B4m2Zwl7v8zgp02Cf:kyjz6zNccvJ+b+RimCKUp

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1