Extracted

Extracted

• • Target

    193c1245409c750c5916db507177e8e02082d66be68c358a43489f595470d168

  • Size

    670KB

  • MD5

    cb5f054723fecc28832cd785336d6085

  • SHA1

    0b53742d4cbe37eaa0affdeb9185abd1105a0e5f

  • SHA256

    193c1245409c750c5916db507177e8e02082d66be68c358a43489f595470d168

  • SHA512

    30325addfec7eb6f6b0b09945c19e4f2b3d026e74ff27292579108219872003d7021f243f4c5a04fc9f090ab670251b0e3e6fc354620be6ea84597ae130aa6fa

  • SSDEEP

    12288:SMrky90zVty0gmf4ai89Jpe3X2h1rWmiG5vrrvm0csV9hztO:qyitpf4G9JQ3G9iG5vrrvm69u

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1