Extracted

Extracted

• • Target

    97a175ac51dc654f5fdec7d541de1437b1e941475b5b4b1ae2c9c1528f1c8f93

  • Size

    925KB

  • MD5

    fd50c367db0b1d278823509df83a2d0f

  • SHA1

    945e74256dbba334e25065c83ad39803f2771f60

  • SHA256

    97a175ac51dc654f5fdec7d541de1437b1e941475b5b4b1ae2c9c1528f1c8f93

  • SHA512

    f3bd8618f5ce6a12d87491fc103a2c737320fd5adeef968a1393abdcc531da9751e57f57faad56e13a01dd75f233cc611d9e0ac75d37b58722d1079e3a06e5bc

  • SSDEEP

    24576:vygSTFNCGLliYQ4IF1d119EKq7hQ37/HWFopw:6pTlbQjLdP9EhQjHyq

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1