Extracted

Extracted

• • Target

    205f9492cb97befb063a2a76111ba2e7902d171e2c84c3e4a6882fd77ab6fd35

  • Size

    790KB

  • MD5

    df3d356ba863856d39273f0156865b09

  • SHA1

    2d40afb6525867d548072b7c1ed976f3d47fbeda

  • SHA256

    205f9492cb97befb063a2a76111ba2e7902d171e2c84c3e4a6882fd77ab6fd35

  • SHA512

    1756d35e7e85cf5a0ebe86cfe965e9d3ca9f937107c1fe0b6acc412aa6554ada2f45543910a7508c208a98e3f968c08b223df9befcd5b7b2babf17d85cd693ef

  • SSDEEP

    12288:gMrEy90eqjOJ3osazfavoJzjysL01au4243TBTjA49ie4uZPsTKVItAHo67:UyiKo1fZJPjenyZlPwFAX

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1