Extracted

Extracted

• • Target

    10e8e668a40001911be6d68bf49a9d0ae762a41e5fd5f5795a4a9af6ea6e577b

  • Size

    652KB

  • MD5

    b255e3128404f05784b176656f3bfe82

  • SHA1

    45d1650a410d828d0ac07a905a7fbb841b3e2881

  • SHA256

    10e8e668a40001911be6d68bf49a9d0ae762a41e5fd5f5795a4a9af6ea6e577b

  • SHA512

    675b485f9e3c02853784326e1bd1a528fd19c8ed908cb18eea8acf8e439d2c8991c6d5dff84400e36a127110ba4fcb5a8530a04a4b9c9ee9959a208f8811f9b9

  • SSDEEP

    12288:XMr1y9075qWf6AuQQ3mcIzBOv5sADms3KpgGTecr8sA7eA1:qyUp3XQUBORh/GvNA751

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1