Extracted

Extracted

• • Target

    4a092f437c21a536ca663016433cc842a80847124b575c913d0bd29492d800d5

  • Size

    926KB

  • MD5

    0af9ddb2bfb51c7d30c20789e8b1b027

  • SHA1

    cee8f44ed5cba084414699306bfb0c5a95555c48

  • SHA256

    4a092f437c21a536ca663016433cc842a80847124b575c913d0bd29492d800d5

  • SHA512

    5518ce30061f6fe27a416c4c6be3bfa3256fe1eeb85ee153563c22f5360ee999f40f1acb379712f90677d3b19e2291a1a6420d346e3166295038fffba87c0ad4

  • SSDEEP

    24576:ZyzDPceHmJX626oZU8/MZ+tVOc3WAPq6J/aVF:MHPc8mJ/x/l/Rug

  Score

  10^/10

  healerredlinedeziknormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1