Extracted

Extracted

• • Target

    c728bab454ecc65b16fbb885f3f020d048a58961f6baf14ab4bd34c2eec4dbd9

  • Size

    787KB

  • MD5

    c5d9a517192dbf3336247ce528b1c279

  • SHA1

    231b293b9470c134a33946293a23882711a3fa52

  • SHA256

    c728bab454ecc65b16fbb885f3f020d048a58961f6baf14ab4bd34c2eec4dbd9

  • SHA512

    3d8d7194fbb1861145b3c37173b3f22fdbfc1af39b62e6376531ed8b711f6e13e813f9ef31be2676d7410d1f274e858944e2c560e301751aa29dcc1740109ef6

  • SSDEEP

    12288:lMryy902cfehm+gnamIF2Ug2rYX1nss3xpgGVqB58vzHGlG1:fyPZWn5gEB11AGcszHGi

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1