Extracted

Extracted

• • Target

    234e9e282e7f2ad1cbbc5ffc2aa67267eb2d5eaf34542df1f7f891fab36aedfb.exe

  • Size

    1.0MB

  • MD5

    f6e3aa012f0f42e0504ba0c5699eb95b

  • SHA1

    c388ba51516a7ada32a035997a30ca2b0e64a453

  • SHA256

    234e9e282e7f2ad1cbbc5ffc2aa67267eb2d5eaf34542df1f7f891fab36aedfb

  • SHA512

    44c3e644262c94521ddc4f72e6922ea4d3e890c88d8aa5870a100a4f528450ce53db40b7a8ea446dea6a23900bd9b337d85112ab3ab8557910958a332fd58ba3

  • SSDEEP

    24576:HySYMy815XptL4iO/T4cjJ0gcXHEmfgLZwbr+A4KlLd1:SNwZptL4ZFj2gc0Pwm1E

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1