Extracted

Extracted

• • Target

    d023689434864dddf3e97a750f171fd4149927bde5f45fe6f302e6b93660ba5e

  • Size

    795KB

  • MD5

    afbe151309256260f08aa69ed5fc9c99

  • SHA1

    919e089ceb749559702ac1d2fde3634525cbaf76

  • SHA256

    d023689434864dddf3e97a750f171fd4149927bde5f45fe6f302e6b93660ba5e

  • SHA512

    5ae5ed87a7ebc4df037d080921b00c7c07660a9d289c729c7b7a093a8b28a50207f3137346e6b78f77586aa17267f1097ccff9418409bc85947a3a4ca125138c

  • SSDEEP

    12288:4Mr4y90dn0u/Ycdy5FFDV1PCnT5WfG7qWmSPlOSIiWL26F9lYCurwdUwN+Q0RdQ2:Qy35Vo5DWoPlLRe/mwdUe+QcdQrvP6

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1