Extracted

Extracted

• • Target

    5b18a2e3b00dd1fba744e01270cab041d898f9b808082cfd7b8b7df2cb3b43ff

  • Size

    651KB

  • MD5

    166e6d804edabcae7350d581aaf2ca64

  • SHA1

    61a34c2a3a67ade50e83154147d1b3039ecc26d8

  • SHA256

    5b18a2e3b00dd1fba744e01270cab041d898f9b808082cfd7b8b7df2cb3b43ff

  • SHA512

    64967910fdadef4dc5934e5f9d775dcac9c661cc2dd380129efbdb172c4665012af309d5f0ac66f0a0b8ead903c5668dbe6d0fa9c9bc0a30794e1e7963f7c2ee

  • SSDEEP

    12288:HMrYy90IDDNt2zMqu4YBF+0+7tb7qZmbZBlP1PIk+5zdmc:/yRDNtLfBF+0+RQmNN7+5Rv

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1