Extracted

Extracted

• • Target

    fca3d4708b291d176a1485e834feb7115a67dc1dc7fb84757681a98e2786d1d2

  • Size

    656KB

  • MD5

    76432b48048c8771887382bb8f47d2cf

  • SHA1

    c68821e54054d410e0bce3e42ea3f53c0237c8bc

  • SHA256

    fca3d4708b291d176a1485e834feb7115a67dc1dc7fb84757681a98e2786d1d2

  • SHA512

    14b75151d8455da0a2a99170dd3fb74a29cdc9c1fcdddee36934bd99e0b11238194116c6d0f77d0dde4aef7b7360ccc9d911f6feba8f048b29bc25328f002f6c

  • SSDEEP

    12288:XMrky90OMEqIiD7D2WW9s0Sn88Rt44LSIZvIqDJxM/NDxqlPeH78crksw:XylMEqIiDvLW9s9n8s/LSIZrDkDxqJW

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1