Extracted

Extracted

• • Target

    06fb07db70ed4fb143cf2a0c48d5f7b412bf0c11ebdc4fbf07cb0c843bdae3a1

  • Size

    650KB

  • MD5

    c8133683f1d0795b420f3b296c226626

  • SHA1

    1e3c9a53b7392870b1e56f21abdaae4748d61ed2

  • SHA256

    06fb07db70ed4fb143cf2a0c48d5f7b412bf0c11ebdc4fbf07cb0c843bdae3a1

  • SHA512

    1a2dd2915db03019d5d9ef95147bcc641c8d9ca6ac02db07f1ab03a50939223b7a7f7e7ff55c66fa1b6e570fbb25864dc44da27846e687eeb9eb905cb8f0b04f

  • SSDEEP

    12288:KMrXy90aFKV/fmsmHmn9psgzMs+WG7Nv7xFmbZoldv8CxLAZGT:dypMdfVmmnHs0Ms+WGxDmNaUC+0

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1