Extracted

Extracted

• • Target

    b12950347e36d94ddf567030ab18a5ef8d47dde7ffcc413db980d1806a121119

  • Size

    814KB

  • MD5

    430dddbe9711137ef1622a0f0581f994

  • SHA1

    dbc5e01342068b20d6c98be3797e24841410bfd0

  • SHA256

    b12950347e36d94ddf567030ab18a5ef8d47dde7ffcc413db980d1806a121119

  • SHA512

    dcea220ad28d06a0e9b302c0f38de21742fe7f7f535db0aef9cbfa6fe2f2759a0403eca75cf15e4567c506bee85b05f5062a43ee521b969e2e6b33df9dea54b2

  • SSDEEP

    12288:zMrcy90sjouGQOUoMqzoPtNw2KPvtBI9toBhcz5sgkI9wxySDQskQxlyzl7wLWe8:vyvGQO+5jPKIHugPMXD/zglUe

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1