Extracted

Extracted

• • Target

    e35a8305bd6e2e4fa779e467ba8ca6fd4c7a864bdded857107c0bc53fa4f4c48

  • Size

    788KB

  • MD5

    88fe836436d203c3e5f5cacd5e99e350

  • SHA1

    5af3a518a80a01240641ca0f3b86728c4a72848f

  • SHA256

    e35a8305bd6e2e4fa779e467ba8ca6fd4c7a864bdded857107c0bc53fa4f4c48

  • SHA512

    2813d43c93703c4a5b9541fbe0c4bdb5419bcf31f00867d5c72f1a501f5b808dd973fbe67be250d076a31972b724b9bf9d7f0eb2847a1b3e0527ea8885f4083c

  • SSDEEP

    12288:4Mrvy90DnngUfbmIpnUHTpSjv2Kb+Z0WTVffEQeU3RpgGVqwB8vmDNoBGsBMEG+3:nyy/SI2zgc9VffhAGtUwNzqB

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1