Extracted

Extracted

• • Target

    b0579275f87c834f26657df6d47dab3d8f5226c9623c3b6ae1a013aa3974c3df

  • Size

    794KB

  • MD5

    a3c899bc6e87cd303c108f42b24708b9

  • SHA1

    ab37f4e422ee463e83218eb4279909cffeb6d6ae

  • SHA256

    b0579275f87c834f26657df6d47dab3d8f5226c9623c3b6ae1a013aa3974c3df

  • SHA512

    123c3a640d904fc2e4039f475e4eb9c154370555a34708814a572dd0a49f1c793c223c122e01f19a83dd06da83ebe589419597ffe65fe7a76da74686af2bf4f5

  • SSDEEP

    12288:qMr8y90cbW8qnH+mO77j9C+P9zXGc6wCrVTeB9YfCurwdawh+10tCQCm6KqEA:SyrWV+mJy9zvOHwdaI+14CQCmVw

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1