Extracted

Extracted

• • Target

    fa33d35c3509f9cfbde8ed4d441fb8d878270d05b5151be15771bbbfc1a09d02

  • Size

    794KB

  • MD5

    5b30ac019150145b1fd8de5447d9803d

  • SHA1

    5dad018ff72eb4d648a08c2e9efbd486820f2111

  • SHA256

    fa33d35c3509f9cfbde8ed4d441fb8d878270d05b5151be15771bbbfc1a09d02

  • SHA512

    dd0fc81a15c9474f3ff88f769583df324d789f34a2ed992629b9d107154ddd757c9ed3d950001a836f755fd740bf3917878de39fad33173b90437c4b833da01f

  • SSDEEP

    12288:fMrTy90nP7c3hvyIf7jyiX8O8Jw4XBkz1pZ7m+EKp1If9Emiqb1ToV+Yju:cyoc3hvVuHXBkz1P4I1I1Em51ANC

  Score

  10^/10

  healerredlinedizanormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1