Extracted

Extracted

• • Target

    2d125c4b3bfa149c43d524e8931140142096fc7a96c119cab15c9b3dc558a8a7.exe

  • Size

    1.0MB

  • MD5

    f3eeca6aa9f46483ab7d3a024bada72e

  • SHA1

    403276188d3dbdb6a87d866c1df8bb3a443e07e7

  • SHA256

    2d125c4b3bfa149c43d524e8931140142096fc7a96c119cab15c9b3dc558a8a7

  • SHA512

    4bea2d89e8004677b82c806bb96f8ca3e8160a23fdd41d4f7bfce710c3ac004c3cf4a9fd85d4484250426c54114c212ffd32b04aa8daf5a26a887105bd0d39b6

  • SSDEEP

    24576:Zy2VVaU5q6XArL4IJaL8XbVaD/gQGJ7jflLcEn8z:M2VVaUpAf4IJdXlLtLrn

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1