Extracted

Extracted

• • Target

    f1d0e06bf9d4a692e9be4b262b8136f910d2f38369e36d0eb60046620d3aa26c

  • Size

    787KB

  • MD5

    cff3108c15dff71be7cd6c7528d2eaba

  • SHA1

    431cfe02fcdf9acc9431528fe6daaf96044a336f

  • SHA256

    f1d0e06bf9d4a692e9be4b262b8136f910d2f38369e36d0eb60046620d3aa26c

  • SHA512

    f84ddcc9b15463da2e4885615a4862376a4d208d3447b464e86403e8333d3ab344e248cd216a2ea07fcb63796338118d99047635c61c81ef5579ec2e095ad10e

  • SSDEEP

    12288:jMrSy90IlqxJ4ubs5SfUJ0LkLHNc5zvyTI773kU1udX8coG0U63kz:VyWZbs5mUJIkJc5zqTE73k4HcoGD6Uz

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1