Extracted

Extracted

• • Target

    2fd384075a3ec51154ef79f41236fc5001ed4e0e11644c9c9a2904cb6f98479b

  • Size

    1.0MB

  • MD5

    d438462168f4c594e3ab651099e0baf3

  • SHA1

    b1f93c930aef8f237019d3a5e59ceb10a9fd3e39

  • SHA256

    2fd384075a3ec51154ef79f41236fc5001ed4e0e11644c9c9a2904cb6f98479b

  • SHA512

    4144fdc662026f5e69f329c73a4afb16509e7298880996d7857cf88b1cb54cfebb2fbc06325e6f8d7b40f6b6f17b02ee0227a9c157660151120934fbffb6a180

  • SSDEEP

    24576:+yG8DqHGInkoFEgRrOO22vC4u1Ewu63E05T:Nn+GInkAlRrB2cVkEdQ

  Score

  10^/10

  healerredlinedizonnormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1