Extracted

Extracted

• • Target

    4a4121691440d44b0a53b6ff1a4b728ab66d85657cc363ffb144b4d7e8fb9387

  • Size

    787KB

  • MD5

    105fedc369ef410fa2327e368c6bdbd3

  • SHA1

    47ade674d563e13ab3445a752a38e811e6db5ed1

  • SHA256

    4a4121691440d44b0a53b6ff1a4b728ab66d85657cc363ffb144b4d7e8fb9387

  • SHA512

    817977dd2465a70671a2531075dec1dca15ae788e377413e4e32253ac5dd5721ec1851c28f6db95e398508ccac5eb4e7127efb984d16e812c8dd7c24ef1b0499

  • SSDEEP

    24576:syJteF1L14zHqJUgzeYBOAWdTpM3Ik8aB3c:b6PL7PzqAwima

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1