Extracted

Extracted

• • Target

    372eeb13046cef20e7789cec3e9df2b425d5b7dfe52d84571ca0c79b8edf0eee

  • Size

    660KB

  • MD5

    6397dc4c8cf60c893c2b0b3db01db72a

  • SHA1

    2a48640b3eb35af2a5757793937fb487bd6a6e5f

  • SHA256

    372eeb13046cef20e7789cec3e9df2b425d5b7dfe52d84571ca0c79b8edf0eee

  • SHA512

    7a482937070a0896f4ce2277995f98e31a1c6aea00306661c6cf6cd5f130d6ec089adbc7a1f85f54c2bad57bdfbb92c32af3f556d101fc434193da07fcb1b229

  • SSDEEP

    12288:dMrky9097j1IDt9/FpE/RPTecl/+MMCWyqbET8zxCpriJ3lT:NycsvbUx8VTyuCa

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1