Extracted

Extracted

• • Target

    e78e5d542a85d3218317f83b489fe780fff2e831591dd9ef3b98f0b6de56e461

  • Size

    813KB

  • MD5

    930ce1872717c80d72f576ac11e92bfb

  • SHA1

    076476334615ab1c80b4f16d8d115eeb463931c3

  • SHA256

    e78e5d542a85d3218317f83b489fe780fff2e831591dd9ef3b98f0b6de56e461

  • SHA512

    281aeccd29b080d61c8a8766a059e19f7ba33bf031333cbe3ff3b8133bffd1dcbed43c4d32856d5e4e69999407d180c6bf6090289409aa08526d621198f237cd

  • SSDEEP

    12288:8MrMy90pv6TqayICoD/K7oVPwYH2dEuSEe7RNIWkMD4H3D2OyvSsAT1rSJPORWS+:oyQvdGm7eIYH2d2d0T2p/MEiKd4K

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1