Extracted

Extracted

• • Target

    05b5ea59b90c94429e3d415b56a87331a50bd3a5f3c4b2174ddb19827fb3fb57N.exe

  • Size

    659KB

  • MD5

    2ae7a284faa420560fe8f11086949680

  • SHA1

    adb22427a48ef1db77bad81aae0922929b167728

  • SHA256

    05b5ea59b90c94429e3d415b56a87331a50bd3a5f3c4b2174ddb19827fb3fb57

  • SHA512

    230f3e2baf3bad3766f3c396fe8640a0c06f583f504149ead62271d54546fc06bee2127244790a2e6bfe0b7bd2f2e8d0ccbb2f630c5e56b3e4d525cf4f6f2b3e

  • SSDEEP

    12288:DMriy90sYaAvzgnZCd8rjGv/WbUdipYXHqw96p:By0LvzgZCdJvyUdipYXHHa

  Score

  10^/10

  healerredlinedizonnormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1