Extracted

Extracted

• • Target

    a2d6e1c7672842f06cb4511e6edf93bd7f2002ea96ed6d6aa2a026c17e98303f

  • Size

    789KB

  • MD5

    d71c4bba837a2db79f0f59563bd39307

  • SHA1

    49ec056d036b1df8f18010f1168c23e46d9fa1c5

  • SHA256

    a2d6e1c7672842f06cb4511e6edf93bd7f2002ea96ed6d6aa2a026c17e98303f

  • SHA512

    def3d79a13ca12dffbb5f0b1f5b3da9d8b9754e31bf2b1874a79809440fdbed9f94096afa05d4de37f85f041fbc6556c69cb0d068b86bcce7254b20d1f8a60d8

  • SSDEEP

    12288:BMrwy90jKgx9pZOAoJPISsL9Vtd/L5vc0TjA9jiegDePs6Tt/6gTAR4SLYk:BycKSgAaIDvD9cOYP7t6HRpx

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1