Extracted

Extracted

• • Target

    172b39493d9159bb8604524f98a04c643b4eaced4e9ca5036d49cfe9924f2eb1

  • Size

    790KB

  • MD5

    be36d3eb51d13ea87fad86fab84702c0

  • SHA1

    e40ddaae3f8bb37171d2803d7c15c7404d3ef7c7

  • SHA256

    172b39493d9159bb8604524f98a04c643b4eaced4e9ca5036d49cfe9924f2eb1

  • SHA512

    6384c07845b97ede764f0e992d7702628d07b344e2d0aad1c658d016149e4086df834434a44e1dc551711c2fcb73708facc5993d4ad0008ccc8a23d6647a039b

  • SSDEEP

    12288:wMr8y905HHLOcIwaD6QEX1sLuxaMxrcgTFAfEieWUVPsBAIDA/:cyKOcxabyiolx71POAIDA/

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1