Extracted

Extracted

• • Target

    b9111378abf5d1a5e8bc6b042fd428705e32808e68f8cd867e9cafca4f27c23c.exe

  • Size

    925KB

  • MD5

    d75390e0a1e3a329e3c3b3a87a5a010f

  • SHA1

    7d1abf91ad6acc847e7c38a8a5361e2a34cf0d05

  • SHA256

    b9111378abf5d1a5e8bc6b042fd428705e32808e68f8cd867e9cafca4f27c23c

  • SHA512

    7dca543103dd03ad9b9356ffa1ce8e985e1b8311d0a647d76b2592ea94022c2cf00dc863e0deff2bfb4a2e5001dce17309541788f7d513a5fa25ae5311cabce3

  • SSDEEP

    24576:WyrlipPo7kWWw+AkTWGIJhbcZfJylMbuu:lxcWHWhrIfbcZWqu

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1