Extracted

Extracted

• • Target

    533725d86a98c1c111c5d694852c40d31466d509f51553eccfbd4b1557ed791aN.exe

  • Size

    660KB

  • MD5

    fe05878fefff64111e4b5702462546f0

  • SHA1

    c682bf7e65985b062ef2457be04ea2491172805b

  • SHA256

    533725d86a98c1c111c5d694852c40d31466d509f51553eccfbd4b1557ed791a

  • SHA512

    f764e8cecfc1ebc5e1b7304bbdebda00bda3501884579553829e26d0f84939bc780c95caa057dacaa9d5530b308a991a93882fd41454e18819f4a30a04f373de

  • SSDEEP

    12288:AMr9y908Sz38vkLagHdtwZTLf9PyH2bhwTe28/51reycRWVMJD:Nye8vkW+uTFw58/51reycAMV

  Score

  10^/10

  healerredlinedoztnormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1