Extracted

Extracted

• • Target

    96e5786c80310a24e30b70fb532921b7c709bb15e9aea504096c837b3bda3f5d

  • Size

    926KB

  • MD5

    a068966a4bd06cc585b608f649ef8a95

  • SHA1

    9d22cad4e1f9d37112f320f9fada490fe19db1fb

  • SHA256

    96e5786c80310a24e30b70fb532921b7c709bb15e9aea504096c837b3bda3f5d

  • SHA512

    c7dd58e5a124215fc1bbbfeab853b5d9f58e6a374ccd8ef01ab73cfc2a07f93a25058b88cd14bb9a0e3fee83d2a18fd391a6e776f0c09a1530aae88588d86912

  • SSDEEP

    24576:fyvIHqHOW8YWNKvknxlnDc4Ikb2YrPaF/F+kK:qv5v8KsxxcjK26SN

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1