Extracted

Extracted

• • Target

    7f11a0d273fa9e1016243021f75567345e8fb2c374861decf46978861a59ca17

  • Size

    655KB

  • MD5

    89ff502f6151f1ba4188fb085614ca30

  • SHA1

    9ea6db14f7b4b638330e554ca5021b80a8ae34eb

  • SHA256

    7f11a0d273fa9e1016243021f75567345e8fb2c374861decf46978861a59ca17

  • SHA512

    9b14b45268d72601699470d333d2edfb4f26ebc4843b12d774be421131a2aea4be96cf4f2a4695eee758124695861b257a86847127a71bf7986994784b0f699a

  • SSDEEP

    12288:eMrUy90I1DYhpJn+NoaFlISnW8it44p3dwhPqR2h5/NI1+U34KmMQSB:Wyqh/n+o0nWl/p3dwMRII15oKQSB

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1