Extracted

Extracted

• • Target

    082fbd9cccd330f5bac1b9a16842660da9e6b089a8ab9b741e5d86ba1539746b

  • Size

    790KB

  • MD5

    5ab0cf69b2ca6fa94d98daf688870e7a

  • SHA1

    b10f71a7b868ecb1557593f767947ed78469325b

  • SHA256

    082fbd9cccd330f5bac1b9a16842660da9e6b089a8ab9b741e5d86ba1539746b

  • SHA512

    bb554da65609ca8df82f58428ea152dff481defaa60ba8bf59580b4b9628fd4355239ba66bcdc97026c408d38922dc7ef5ee5c88cabec08a3dcf63f473208289

  • SSDEEP

    12288:3Mr8y90K8T19SrqdcZJ1ZG7SmIP1jXx04Cn4/7fmTSAyiie8O5PsFjVwvjzyBZkt:nyi7AqSZUj2r/7A7PIkfyDNW

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1