Extracted

Extracted

• • Target

    77b5aa71d7dbf31b25e582c7eef9711c7c0f06c66116f81656ecd002e475427d

  • Size

    660KB

  • MD5

    903b459518756034fb867a371312df8c

  • SHA1

    49ec757568dd168d2de6a28761863ca9177687a1

  • SHA256

    77b5aa71d7dbf31b25e582c7eef9711c7c0f06c66116f81656ecd002e475427d

  • SHA512

    0575c602a95aaf78b9908a04563d584059b08109fa5bb2e63f2c122e7988590c491038914cc1411bb55d0f9d715dd04c8a0dbeecf43fe0d66f6182e11e0ac574

  • SSDEEP

    12288:0Mrhy90wsOCPqJgmNQ8vdWga1/SqFdkdiJWgsK0XOE2+/l0nlKTe7v7zJ1MTrlPR:FywOCiJgmXU3CdiJWbKNb+/lZAj9WVqa

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1