Extracted

Extracted

• • Target

    477344f8142df112cdb8ee17d1568b72921c6e580c88cd59d4420df8479403b2

  • Size

    661KB

  • MD5

    4eca31133dc3de987c1479912ef5db06

  • SHA1

    f63ce87acabddca515ba3497720e3a287b474b13

  • SHA256

    477344f8142df112cdb8ee17d1568b72921c6e580c88cd59d4420df8479403b2

  • SHA512

    f96345eadfd7cb9ee39acb2f88080832761735680bf9bc515d59baff220975523ef5d6632f98c444f06de17596ebd27a5c51bd265b0b2664f519c94196a035e7

  • SSDEEP

    12288:9Mrgy9011IlyDr+0RGZ4uRlc34j/kPTeczwDhhC9yqbMT8ATbZAZJ8A3fxBLI:xyyk4+0RGZ4Me3QWAD6yj8Jv3fxBLI

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1