Extracted

Extracted

• • Target

    e5e76998091ac2cc7f6d015760d9bb97e0907982ab299effc5c07c760d511733

  • Size

    814KB

  • MD5

    ae72a9c8ccff4915b57d37bf905c89ef

  • SHA1

    d1e14e84d952981c9c5cd9bd7339455f46176365

  • SHA256

    e5e76998091ac2cc7f6d015760d9bb97e0907982ab299effc5c07c760d511733

  • SHA512

    6f41e55de582b20a82d1274977fd95924e0fc7195cbac911d8902da016a96a33b52bab07b8cedd0106f0f5b0c59b850cc6c634b8e0d9974ecf6ccb5b18b6ed9d

  • SSDEEP

    12288:YMrQy90x0Cppyvsgu5N9vuNWoV3fQ5Ncz5KsIYwxy2DQhFtxlSch5ENia:oySPpngu5/u3V3+qMnDoV3hmQa

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1