Extracted

Extracted

• • Target

    88bd63c8595641ae39f725581225cde2dd4fba625052ab0643a4ba881cc4fcfd.exe

  • Size

    926KB

  • MD5

    94e6ce853832accfddf81e1bcd76e268

  • SHA1

    9a9058599f4d260c35e12c07b8b2a4e999bb5d1d

  • SHA256

    88bd63c8595641ae39f725581225cde2dd4fba625052ab0643a4ba881cc4fcfd

  • SHA512

    66309914c506a1de7f074300eb784046dce9718668606feb3f8412a57fe010501a5502e18c1dc2b3d908f309d0c7d2b2dfe794d22d7e8b2d28157c8f8abc596e

  • SSDEEP

    24576:8yF7GlDILSs2TvZgYAfXem/WAPq6B6lI5n:rF7AD0C7Af9G4rd

  Score

  10^/10

  healerredlinedeziknormdefense_evasiondiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1