Extracted

Extracted

• • Target

    b06cace9343a57bc850006f7fd7b49644051c1607f78aa1109f53cdb37964426

  • Size

    652KB

  • MD5

    61013a8cf28d3c6cef09eabf50d8abb3

  • SHA1

    8c6477463ee8ccacc27bf75d1a321b463b239907

  • SHA256

    b06cace9343a57bc850006f7fd7b49644051c1607f78aa1109f53cdb37964426

  • SHA512

    9dafd3aedf1f49cc1fc8530d11e39b03d61c4541c4aa51b581b34c366310357b95b7db14d5a54495668e09d328eaf5e004af3cb367ea35afac93ad53ff9d88c3

  • SSDEEP

    12288:oMrJy909uY+QbTEGWaO5Z4hDtceHZ3gpgG0TIr8fvgz3PDM:xyKxbwGWd/4hD9ZGTivgzbM

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1