Extracted

Extracted

• • Target

    fc6ed45c4fd4e89c3ff2dbea866c702441928b66f0a78007cade33002bef9e16

  • Size

    651KB

  • MD5

    71fb0d37a4870325722c6eee670cadd9

  • SHA1

    ba60ff1aa001da1a6e04a6129b3cde4643a0d860

  • SHA256

    fc6ed45c4fd4e89c3ff2dbea866c702441928b66f0a78007cade33002bef9e16

  • SHA512

    dd04eefede1a157ca28c432161ee3e3462630e00dbe52c1628852fa1be48ab6603d9b46c92e2b8f699e3a527c1ddbec8e7980a92af7f3a67bc2017b9984bbc03

  • SSDEEP

    12288:+Mr+y904G8ak+cy2IHy6F7CY91hPoFu383+pgGUq/r8CQE36Kv:gyhG8alWIppPmTGRbQy6G

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1