Extracted

Extracted

• • Target

    02fa71045fcdf2c1e60d4e2fda56e4149b8db47e881ef7b2cc0c9281bde3bf45

  • Size

    660KB

  • MD5

    62ea6df2603facab03e428111a165cdf

  • SHA1

    e2cfc01971cf4ffdcad94134809e48fceadbf9f6

  • SHA256

    02fa71045fcdf2c1e60d4e2fda56e4149b8db47e881ef7b2cc0c9281bde3bf45

  • SHA512

    247412169d85ebf26cf80aa445b1ac5a8c1d65ea0e4e221c03aeeb14b4b9386fc35b27e072d0074bc8c53fd095250f80905a091527d1329a87ee1fc3b10ce36e

  • SSDEEP

    12288:0Mr8y90ZtrOvAeIfBbAs/pKTdlY/L984ItpiBJs90CEKo8ljJ:QyotJesXUTdlYh84IGs90so8ljJ

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1