Extracted

Extracted

• • Target

    5659b55644a0b64b1d5a2e6234f206e6130ca4b03661d9c425f12b241721b4cf

  • Size

    814KB

  • MD5

    e3c80662709dbc7b02cce8a14759b6d1

  • SHA1

    e6e9cefbd809655945f932699fffa014c67979b5

  • SHA256

    5659b55644a0b64b1d5a2e6234f206e6130ca4b03661d9c425f12b241721b4cf

  • SHA512

    ad24c22d279e5a69f6a92158322c1c3932bb8c2a822401fe30dc7fcb3c8973f27059fd2ab5f7a463574d13165de415b4269a99759eb86bee938a2827f9c04bf7

  • SSDEEP

    12288:VMr+y90DtQicpUUIQxC8oWXkb+PjekENXSXsF/Ocit2aFL5+3/MI3oXiLOpxtCUI:HyM+8QISUb+FM0sF/OcUL0/fibHQU5O

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1