Extracted

Extracted

• • Target
    eb910e1c7fba98065201e5bec79a9ffeb0048acd7ef3bc73d0544ce44092a4fb
  • Size 684KB
  • SHA256 eb910e1c7fba98065201e5bec79a9ffeb0048acd7ef3bc73d0544ce44092a4fb
  • MD5 a8043aa05b1bb9670ef3e95b4b237506
  • SHA1 f1e6a271c0859e15dcb7afb1e439dceaac08c91c
  • SHA512 2e9447c02737c86ceec893059cb862e9feb45ba4d2c91098f06615673836db0120399ec2d0a2c236de09253aeb1dfb8f477ee8c7e8a064132c63d5efdffeff44
  • SSDEEP 12288:0Mroy90HFw5QtiZPkHqLxBsvWtk2loNS8pLNrSgParN6q6Sif+pPu:MyCwd4qLxmv12qfzf3fUu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1