Extracted

Extracted

• • Target

    1a363edb33139a0e5ee7a0e9404f5b64145f13d8bd75ddd90e2b253101de0520

  • Size

    787KB

  • MD5

    db8e0b08bf03dabcadfca79b19dbdff7

  • SHA1

    49149cf15d423a4883ebfe1fa4e17228cebd870d

  • SHA256

    1a363edb33139a0e5ee7a0e9404f5b64145f13d8bd75ddd90e2b253101de0520

  • SHA512

    c32e03f643d6231c8a7c16afd3991bd4d2b5208e1d88bde3e8bd40977068f8578c8ee150f516baef45b73c9587ef3567aba34c5ef9a6670a3bf4ceaaaeb035f9

  • SSDEEP

    12288:DMrAy90pBnmHtmG/FWGHnwaQqNhlLMoWeNixgii5731m3ZPlFH82f4BC6nVI:Pyi2fYGfQqNhemNixgHhmJfc2fvAI

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1