Extracted

Extracted

• • Target

    6102435f1c4ff75e3982ecf59df98bb61e699d4905c570e106393b7036da7170

  • Size

    815KB

  • MD5

    6f794b0dbbe56248df2cba856bc1e0ee

  • SHA1

    6fb0a400feb1ad50a61df34f0bfcfd2474a2207a

  • SHA256

    6102435f1c4ff75e3982ecf59df98bb61e699d4905c570e106393b7036da7170

  • SHA512

    f7c1d0258e363e5be03946f7d68b5bca4c86860ca26c661b631870595eefa8f6b73737fa2327ddff976efe145ef58cb3e23ba23f2d2c939e7c50f5ac73de04ce

  • SSDEEP

    12288:iMrJy90J4g4FWefLAYKr3vRtTthRdEasEeJMc5yCFE2m+zSFYLSrSo1zYAUt4n24:Xyynez+xdPc5y12ZOz31zYDin2VG

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1