Extracted

Extracted

• • Target

    14baab2d9128035ef8cf0caf28c4ee3a4638138814d88ed04086cfd3d678780a

  • Size

    650KB

  • MD5

    0f0d06f8db4507f6baf5f7bd31101923

  • SHA1

    e6f7151c7d56657bf5d6af02109262a67b77b319

  • SHA256

    14baab2d9128035ef8cf0caf28c4ee3a4638138814d88ed04086cfd3d678780a

  • SHA512

    b9e8aaa1472fd56d64aeeab374416b97a698e61adf8aeeb8e1ac5195179385941dfc1454663ffcf75a6ffa2acacc781b20903ea997d9b352202c07099f60e9fb

  • SSDEEP

    12288:TMrdy903cmFbjHbLzh2Qu9fKDMzr136Ugn1ERuuITY03Jx:CyFuzbLFu9fKDMv136R2uFTXz

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1