Extracted

Extracted

• • Target

    292de6aa48bd2b1e6493176788abfff01e60f932f1c38b579c166424debd0c14

  • Size

    794KB

  • MD5

    372350cfc5ae01e2f7b6f2c678628352

  • SHA1

    9370455e920c58af983ce0c77128caf611b3f317

  • SHA256

    292de6aa48bd2b1e6493176788abfff01e60f932f1c38b579c166424debd0c14

  • SHA512

    0cb9e61fdca1d2700caf1478e344b5cfbdc5c8bd84c1f3d9d29528f6760eb6f4f1d69ef173a4eb012244303ce27f61b4b5782d02ad462c0dfdfd158c40493b50

  • SSDEEP

    24576:dy9bDK9Sgp3Qj1X4kIHtUlwdk69qI7QkwtZI:49b+Sdj1okid3Q/t

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1