Extracted

Extracted

• • Target

    54596745f60c619c95ce4b253f820b1b92fbd6a91356345aecc981e2d91e44ff

  • Size

    790KB

  • MD5

    54e232ae256ff95221f5d3c157a1313c

  • SHA1

    710d5e5660cf1e3d9e619b4fb88c8075d6a8c493

  • SHA256

    54596745f60c619c95ce4b253f820b1b92fbd6a91356345aecc981e2d91e44ff

  • SHA512

    eca329630c5ee46f141c6c1c99bbeef4966a7a8d5a3f41a79c0acc0afd0b995c7c52fac1222df40d02489795c391e7f6c5e7ff3f35565bd91a8dd9bfb6224c8d

  • SSDEEP

    12288:rMr0y903lhBffxlk9CLTXArd2N1TRAPbiesWuPsidD0wuRfT:zygbXxlk9CXo2T7P/KDV

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1