Extracted

Extracted

• • Target

    1747c03a01fe167d6908806f4afb11e0efb90265d87493bbd306dc0709080855

  • Size

    661KB

  • MD5

    03bf5f1392f26b775fcde0d740b3dbd6

  • SHA1

    d2b97553f694e3a5d72396c6c16f7ae35bcd29ef

  • SHA256

    1747c03a01fe167d6908806f4afb11e0efb90265d87493bbd306dc0709080855

  • SHA512

    842b8c2fdf0ef3499e1ace1f4aad5b22f3e4e4343da429bd41ddc62bbc8e37d115fdae12dc9945c31fb75363a810663a5594e67718961d9cc870d4ade7db0f47

  • SSDEEP

    12288:4Mrmy90+/o8xiedsk/qPTecw/UnvCPyqbmT8Nswdf5UIA4:eyTaeO0ExvyyQsyRUIZ

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1