Extracted

Extracted

• • Target

    7d12e1fd566b16094887dc5599ddb414854b48e735d1e8453051bd4b732999e4

  • Size

    661KB

  • MD5

    f922427c7dbdf3fdb8fad7a3f0c2ed87

  • SHA1

    739dea9e6b1843b8c0c523faeb56c25ffec1651d

  • SHA256

    7d12e1fd566b16094887dc5599ddb414854b48e735d1e8453051bd4b732999e4

  • SHA512

    592eb5b7e32c9c802adddba381855e870c1e239bf41bc731ac1f4ef029746f0b3df8ebc8188b6223bdb66a4222f6a9566f6c7aeca6b2326b194e4dabe332eb8c

  • SSDEEP

    12288:BMr2y90nkx4/Bw5RfxN9lFJW4OtAl0rLJf4IspiFJn1S0pel3m0B:TysBw7JfV7WAl0Rf4IdnLG2Y

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1