Extracted

Extracted

• • Target

    b2f38e13d568ab98cc613f86a55a7d9b1f38c1d3c4ed7e1243102379614998e6

  • Size

    652KB

  • MD5

    c91981349a00543863a200d2d8be95f8

  • SHA1

    19ebfee9515bb049f5eff3bbbe8a02c7d01c215d

  • SHA256

    b2f38e13d568ab98cc613f86a55a7d9b1f38c1d3c4ed7e1243102379614998e6

  • SHA512

    e047cfefafd47d72ca1e7f6785c0b48029d481eae424384bf70211933f999248fa2910ff8c57f518ae4f0ded522d74a1cad6317156fb8e9e475c163d64842552

  • SSDEEP

    12288:RMrny9065Yn5E8GoeTeBn5iNrxwPDQ2VB3xUKNE60D2q:2yH5Y2zEP88DY2q

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1