Extracted

Extracted

• • Target

    2200d05ad74d630d251cdb6aa659ceb78675831b3904055135624b6c36cb128a

  • Size

    652KB

  • MD5

    9bf262b54f240affe921d93bfdc48d51

  • SHA1

    aa77acb8a17e7a0e879c38b0e7dd6053d52f92f8

  • SHA256

    2200d05ad74d630d251cdb6aa659ceb78675831b3904055135624b6c36cb128a

  • SHA512

    cff56ed580b22452af7ef2e95438272f6ea994f93d34f91097e9bf9267a831cb2524571a1497303d61d3fb2332503614b44eeb5bff537d55a49b1fd9bcd47e82

  • SSDEEP

    12288:gMr2y90d/enu2tdeb1yowTOTsidrfmP232VrKwd1kFebZ:myI2C4DPMjAF

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1