Extracted

Extracted

• • Target

    e9a3c6b3bce07cd3393b5912abdc8333801f78c90dffa4c50eb6874e8c3a92b6

  • Size

    801KB

  • MD5

    f3e52107bf5f01d292eec7d54a3968c7

  • SHA1

    121572755e63cbf764da14ccf4bcbe7342a814e2

  • SHA256

    e9a3c6b3bce07cd3393b5912abdc8333801f78c90dffa4c50eb6874e8c3a92b6

  • SHA512

    596edaeff331d8323e7da0d77cdab2c6de5369b9c022feebb70dcd78433a806c3424ebe9ca0a6f31cfebc4242682d5a367560321ba11ff5cfe95f8779c6c7df7

  • SSDEEP

    24576:UylhTtvXQ1EJbbfBohiZLjB7Pf2IB2Gd/gJ9392JUKRu:jlh5vXQ1wtFjB7E7N6UKR

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1