Extracted

Extracted

• • Target

    32ed704389c95647e4e6ce229f14cf00915ec50359c8780dfdbe9769a92d367f

  • Size

    661KB

  • MD5

    84300bffdf494e9a2f37549caeafe468

  • SHA1

    366e3ab3378ce1932b3f355a32ebf03e267aa798

  • SHA256

    32ed704389c95647e4e6ce229f14cf00915ec50359c8780dfdbe9769a92d367f

  • SHA512

    a97e4597ed3a485d2ba17a04a7164a6a5727ab1bfa8d6e3362e2a7f6db89405d4fc6d5f6868be2e2a7e9b3d40c38be5fdaca4c59e18685c061ceaf06e2a4ab18

  • SSDEEP

    12288:DMrGy90j92fhvMP4RVlfkIY9OheaL4Q3USJ/bcIWyoLr3bSpyUABMLon:Zyqi++lfkIYKbMFG/bcIp6bSYdMO

  Score

  10^/10

  healerredlinedroznormdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1