Extracted

Extracted

• • Target

    772e325cc9b8bc344a67f7b9b2f9e43ed4af0c0f72c8f98dbb9eb78699eeed6c

  • Size

    661KB

  • MD5

    898cd8b4710dd6af7f084f807c0906d9

  • SHA1

    ba0f63edbdb86edb15e616a9632d8c6c9baa3f78

  • SHA256

    772e325cc9b8bc344a67f7b9b2f9e43ed4af0c0f72c8f98dbb9eb78699eeed6c

  • SHA512

    fe158705ed05fbef2ce82d3dadef761d1f291fcf2a99f1df7e3a71fdbc4351ccc3034d9fa7f09d8f7c8ec4961170e2f972db2652b22c5d3569a7ece18aa57977

  • SSDEEP

    12288:XMrYy901pZlblKiWIOEGkZbjBfy7ytHYzS2HxSzcbp30JL2s:jyelxHlTZbjBJ4O2HxE0EQs

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1