Extracted

Extracted

• • Target

    bed856928533116e29c20af9abf3e18c7a2da493556def8c6a253c886099b650

  • Size

    650KB

  • MD5

    382f29ff415cfbefb30e5a90ddbd8a69

  • SHA1

    8a7fac4a5a6fc31a73276286e63fb8597e58ce1d

  • SHA256

    bed856928533116e29c20af9abf3e18c7a2da493556def8c6a253c886099b650

  • SHA512

    85e51bd0ca75a42e341ed4c9da5c6d3b6845e1b3bb41086ab4f021b7e757cea1bd8e596fc6e3793224c601084488274129f2400bacef001ecd5711d4d3400e5c

  • SSDEEP

    12288:eMrzy904m73jsxQGvoaYZcMQUTVu9iKj1zsL3cU6DgDMubd08HwQ:lyDWjtOWSspu9iKj1oL3cTju57t

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1