Extracted

Extracted

• • Target
    e78e5d542a85d3218317f83b489fe780fff2e831591dd9ef3b98f0b6de56e461
  • Size 813KB
  • SHA256 e78e5d542a85d3218317f83b489fe780fff2e831591dd9ef3b98f0b6de56e461
  • MD5 930ce1872717c80d72f576ac11e92bfb
  • SHA1 076476334615ab1c80b4f16d8d115eeb463931c3
  • SHA512 281aeccd29b080d61c8a8766a059e19f7ba33bf031333cbe3ff3b8133bffd1dcbed43c4d32856d5e4e69999407d180c6bf6090289409aa08526d621198f237cd
  • SSDEEP 12288:8MrMy90pv6TqayICoD/K7oVPwYH2dEuSEe7RNIWkMD4H3D2OyvSsAT1rSJPORWS+:oyQvdGm7eIYH2d2d0T2p/MEiKd4K
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1