Extracted

Extracted

• • Target

    4f5eecd618051b870b508a9a91fce488f250bdd12a74723558daedeaa0006534

  • Size

    813KB

  • MD5

    98155fd15f1821608e5514c674d82f8f

  • SHA1

    80559adc7b50c1fa94f423cdb2788b689f19afeb

  • SHA256

    4f5eecd618051b870b508a9a91fce488f250bdd12a74723558daedeaa0006534

  • SHA512

    d982cab69a3597775b287973b86285207cdc9c526f2fba3a7b6d86f325dfa20e37d373bf11d963f1d80f6d57800ac2a98672e588bd3e1da5b2523b765eecf78d

  • SSDEEP

    12288:DMroy90Bgjf4/yJvEqC/8dVW2ERpvSx2W0/OuvLanLc+3gMpxhXiLO+xtXtKCnHZ:byugjQ/r98wlphWfLHgMnboJtNHZ

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1