Extracted

Extracted

• • Target

    d466204fa35d7a2e847e29cf8289a6df1b39222aa8f083e5f2b7e97645ed0401

  • Size

    789KB

  • MD5

    29cf80380ad66b8bb365a7e5478fd370

  • SHA1

    118725ab068f1b4a4e34ba391957abe8d4456774

  • SHA256

    d466204fa35d7a2e847e29cf8289a6df1b39222aa8f083e5f2b7e97645ed0401

  • SHA512

    c1de950b7ce1628d39929e393168bb4c4ba66ca779908ba87209c92bc83c282d941a73ae50e04ef15d5ed42ba0e15ed03a816c1b749ae331600f2a00c6aae159

  • SSDEEP

    12288:qMr6y90a3zG/P3AMZqmKyLF/9nsQsAaToABhiedwIPs97VVklVWy:0yL3i/4MZzxp9sVrlPuklVl

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1