Extracted

Extracted

• • Target

    ad81d03cb9513f71cbf79eedcb55cda115a0fb4f0ab49251c110b1e60741649d

  • Size

    786KB

  • MD5

    e4e015424c35c3044bad57a16967b0da

  • SHA1

    43c87569d2e66fc6f9144826649fa75295ef66d0

  • SHA256

    ad81d03cb9513f71cbf79eedcb55cda115a0fb4f0ab49251c110b1e60741649d

  • SHA512

    17ca7749afb8dcebd874a951bca4fbfa07d5a65d6206fba61f2ae5805b772aa34c8a74fb80c702b72ae98f8f677cef922f3efa0fbfc9a20ae96e8f413323f028

  • SSDEEP

    24576:ByAtuWT+CRt3yOTKSJdbYw6nJYcM3pz8u818m:0AtuW5z3yZCdbYwnpWu818

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1