Extracted

Extracted

• • Target

    baad5692d4054a4843312d3ce627a97968c8bf03550c23598a70d6767f4fd927

  • Size

    926KB

  • MD5

    f3cf278ffa35c6e51b0e0456f262bd5d

  • SHA1

    ba52d58108f1b9aad7b47a56401f0aff22455543

  • SHA256

    baad5692d4054a4843312d3ce627a97968c8bf03550c23598a70d6767f4fd927

  • SHA512

    a952e86b9a51163bccab10d206e8d3ce3f269fc3694b1d0b4bc427bf801200a674070921934f7597f68cf9cb3000e3219898d4c77461d9e493f2c07976504442

  • SSDEEP

    12288:WMrfy90NrpsDzbShf46qZUDAKmg7jNlPU9Xi4Izpi/Jg+HOb9Jjp1c47lmCnjdvQ:1yuCDz2OG/NlPyi4IYgjP1FvnJv//el

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1