Extracted

Extracted

• • Target

    aa7e77c25cb8cbd7c6f668153d70a2a423d2bf5acf2e499a904160796bffcd29

  • Size

    801KB

  • MD5

    0b4fc8dc110dfa8d960cfd634bfc0cc0

  • SHA1

    a7fe8a5c400e05b0bbd4cde25ea3066f30b57904

  • SHA256

    aa7e77c25cb8cbd7c6f668153d70a2a423d2bf5acf2e499a904160796bffcd29

  • SHA512

    7483274fdefa37af331796e6cf456ee958fba1b79c5b6789a41100091ed98062aaa8cfd2061e17187ec2f0e587c945f42164d23ea30ff9e69a274ecef836f1fb

  • SSDEEP

    24576:qyknUi0Kuyz/K77TsOKjBEKf2P5xW7z9Fod:xkTzuyLpjBFo

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1