Extracted

Extracted

• • Target

    eb50df9d00a306a4416ca142dab12cc30960e35ad52a1e34b44a09141b1e9d08

  • Size

    713KB

  • MD5

    3ce1b2cdcb034a4fdeb87d2c9a86f6ea

  • SHA1

    a8e18f2e2bbe4875759f8134ba541b7c18bf7ee9

  • SHA256

    eb50df9d00a306a4416ca142dab12cc30960e35ad52a1e34b44a09141b1e9d08

  • SHA512

    26e480d7a08bfda7dbc932f6e4418f179db07d8d207b133b3ff15895fd49c7a7c777804d890619c2c44c0c2757079d415e3db3776672a50910dc8f5cca0bbcd7

  • SSDEEP

    12288:aMr8y90VDIzgBlXCbMEqNEBy7qqSosoZIZ6JrePb+2XWkRPOLavH24Kf1:OysDIzWEq+s7BSobZIZcSPb+GPOLa/7U

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1