Extracted

Extracted

• • Target

    6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785

  • Size

    660KB

  • MD5

    64a4e65a34086717312b517202d15f61

  • SHA1

    ed52fc014573c10b4bca47ebfbb3288929eb5428

  • SHA256

    6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785

  • SHA512

    386e41bf368dd0eaa6cbe92f84a2158b19de257815d5fd1a53ca3024bfe5a465bee8bc9c36377c587e8814bf80c9dbc6f0190f956a6d83afd97e59e122e2dcf3

  • SSDEEP

    12288:VMrey90Ly6h5jEVL9e1a9dmBZ12kAB/nPTecUCZdPCPyqbuT8+7rink2dbCh:zymy6DNBZrgPfZKy/Z2pM

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1