Extracted

Extracted

• • Target

    b89fe52699da933365341cea2dee258692c127665029dd5ac22796de23c7da0c

  • Size

    650KB

  • MD5

    208891c953f6b2d1e6497be64d4fcd3d

  • SHA1

    b89bb22fa90b7e9ebaecf550025918f69909c2db

  • SHA256

    b89fe52699da933365341cea2dee258692c127665029dd5ac22796de23c7da0c

  • SHA512

    086aa617a84b8d67b63ce9e4d04ba659efb8923d5698da2bf0bf3b84dea40fb1acbcd504518f799431b02eadd70945c5c427dfc4ea6ef3974e7e5279f69215a9

  • SSDEEP

    12288:aMrTy90ml5+HJgPDc/Zem9nAppddY+QM7fs7JEmUZvllCQoKI/jrx:RyXu9eddY+QMQSmQJoKIx

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1