Extracted

Extracted

• • Target

    2b11dfad27115e02f5a053bc5b8f8651718e82a18540e054186597ee3559a7e5

  • Size

    794KB

  • MD5

    6de57b187b7e56d7706451fc9340cfa7

  • SHA1

    52079deafd7b3fc78e70c59588ffb68121fb304d

  • SHA256

    2b11dfad27115e02f5a053bc5b8f8651718e82a18540e054186597ee3559a7e5

  • SHA512

    4d55b8340ea74f1bfe8effbc69bb4c098f207ead3dbc06a4ee3c1051998233c4d0db1138b7b2487c9fff6ed4036eeefa510a224c0f1bd4383689dc5adcfebc81

  • SSDEEP

    12288:IMrPy90mB9SsV4GqgJpKwI8Rg8CrVTeg9olCurwd8wd+3e5cQ7Qc2z1GUi:HynXgw2CVwd8K+3AcQkxzI1

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1