Extracted

Extracted

• • Target

    7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe

  • Size

    661KB

  • MD5

    7f514482ee5ce057f3a39c769298a003

  • SHA1

    cc65f838f9362ed185263b02541e24b98efc5102

  • SHA256

    7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe

  • SHA512

    afc496348442b14c09ddd6bcd80eccfd4e642e01e868db764aed2421bc48b04437ef148fe982ca55b45b714372b55d48e250ad4783ff5a78ac17e53af824322a

  • SSDEEP

    12288:dMrcy90BLgtC6ZJT983Ndx3ppCUhhl2gwdL4I5pi4J6AhwtPzGODU:Ry6strZJOlpdhl2dL4Ir6ASP5Y

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1