Extracted

Extracted

• • Target

    eb272acb58b9bc98837b85ade912d531c245589a2e265f13672d61772ac1223f

  • Size

    660KB

  • MD5

    23b6ed63145611a7f9f4deb713e0dbd5

  • SHA1

    59ddab499da83142979af9392f9106fc16e4a3d7

  • SHA256

    eb272acb58b9bc98837b85ade912d531c245589a2e265f13672d61772ac1223f

  • SHA512

    de64af5145b3e239d8eac9730d5d966550ee75d969caf5c8fcd7d616375528ef4ac960b36033fc3b6b3f23a4c70a200103c56d2625b786abe6410e6a95771b8e

  • SSDEEP

    12288:lMrgy90GffeOnObN7dMlFWZWJFdODmhjxwTdw62HK75C4a2nAFMX:lyF+8Ob1dMlgsJQmBk7Fa2AyX

  Score

  10^/10

  healerredlinedoztnormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1