Extracted

Extracted

• • Target

    c3365971d49379f6eb5b0ed706324f374aae110abe2f9f080cf18dc8abfbdbd2

  • Size

    660KB

  • MD5

    1fecd06757f18463f006cff3329b9e4f

  • SHA1

    f0dde78f6cf613eb24f3e4d7de03e1603a52c549

  • SHA256

    c3365971d49379f6eb5b0ed706324f374aae110abe2f9f080cf18dc8abfbdbd2

  • SHA512

    370860efce31241500372174d2c831252c322a27a1889cf899d5dab50e395232312e73b7ece3119aa7742d783513443c9aec9cfbd452a137f369fdd65d8321af

  • SSDEEP

    12288:UMrcy90VnfskNZ6O5Z8QwZHgZojBfPBymsYzC2ZVSzcY6SG+Y7UajVLo2yOc:gyEsGDfAHgZojBDL22ZVE96F+SDm2yt

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1