Extracted

Extracted

• • Target

    4383fc14f0a83433d19edc40ace52fc15fbaf2dd9632488c62984e30e83ce31c

  • Size

    814KB

  • MD5

    3fae10712581934bcbe94102ee90862e

  • SHA1

    b423e37d04e51f64b412c7a9f3a0b2ae0246b586

  • SHA256

    4383fc14f0a83433d19edc40ace52fc15fbaf2dd9632488c62984e30e83ce31c

  • SHA512

    cfe78d6ea1ea38a8e25474680614d77a511b3d130c6bd5eb6aa62cefbf03b9a454b29e97891c6dc6d7a0b83cc0f7ccbceaf69aaa3a17b652d754f73dc89fe87c

  • SSDEEP

    12288:yMr+y90E7FVi5iFGJUcEVwW5rfICPB2IZ/Hz2f4rS7ygweb5kp+:Ayv73TGCcEVwgQW2ITLEpwe9

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1