Extracted

Extracted

• • Target
    ca0acff592494132389b9d0604769c8bf72462c526d23b9c44d0c05512f8da93
  • Size 814KB
  • SHA256 ca0acff592494132389b9d0604769c8bf72462c526d23b9c44d0c05512f8da93
  • MD5 6f5f3f58c516439e7dee0b626706c41c
  • SHA1 5b2f74f045cba13e36ff26bbb4b9ec67f2a639ef
  • SHA512 e75efbd96ce7872827a1dc36f89ef97a4ed944da4b0567be36630e1d0517d1af2b0031099e595f15f99563c4a9f55b1ffef94adfe76d4bf19f513f00acf53168
  • SSDEEP 12288:YMr8y90RBL6U7skFNqO05JaaGlPdckaVpWfyivOtzhJonk6iyn0OdC6fWjpD8AoV:EyI1UkaOqilPxaVDivO0qy0OdX0Ib
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1