Extracted

Extracted

• • Target

    dd28757ba337789b9a949b429a6dd126f498846bfdc22e0aae928380e5db0a85

  • Size

    1.0MB

  • MD5

    b550ea8ae211d27302212c8ad9063dce

  • SHA1

    e2839c44bfb3d96632977fc5c901e77ba426e086

  • SHA256

    dd28757ba337789b9a949b429a6dd126f498846bfdc22e0aae928380e5db0a85

  • SHA512

    56faf9624e3e9e5dc5e1e932d0a6eef3311b56dc18bb4a75da398860403e70c8202d99f70d559a004d0d1bc9398bbc2d05821a97b87b1a75c2838fd02fd8f7ef

  • SSDEEP

    24576:OywkWX4luRsI0LCfbzv1YClaNyXyw+SZBtDEC+nO9Gi9K9:dwkWXSueIFfbz9YCUiQuKC+nO

  Score

  10^/10

  healerredlinedizonnormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1