Extracted

Extracted

• • Target

    12c01679662ec6ef40ee9ec01758265fe22134590fe2a8b9494b2d93f48b12cb

  • Size

    652KB

  • MD5

    0d84fe1bdd833e58f8f5cafb107a9106

  • SHA1

    1fb25c4f5cb3b12bf418843386e1a26916cec37e

  • SHA256

    12c01679662ec6ef40ee9ec01758265fe22134590fe2a8b9494b2d93f48b12cb

  • SHA512

    783f74906508a9767adaf2172876cc0aecb3703be606064722ac38670f92c76f55f0bdddd724b3a120ddbb9105ba37c7087acc7842f6f9778e0c901da202ba06

  • SSDEEP

    12288:wMrky901Qwz+MM7Zvb4LTAo6T/Si7irrJaPsAGVYEo2NEl+wU:EybwJM7ZTzBPrUo2qlK

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1