Extracted

Extracted

• • Target

    3ff799e7599da1c754329d5f9fbb433fd4dc3b30061f71050e04843c200fade0

  • Size

    672KB

  • MD5

    44ee8447ed131d75c7b542f5fb7e8885

  • SHA1

    9c77afec5925ededcc7328f49947464dbdfb4ac0

  • SHA256

    3ff799e7599da1c754329d5f9fbb433fd4dc3b30061f71050e04843c200fade0

  • SHA512

    cb2337c382c8a294a0eb5447a4a3e9a3db1b0c923e52c0dbda53f99539192598eb1f1f2152050c05c94f303d5672ecb164845c80648b030a834204328a184cc9

  • SSDEEP

    6144:Kiy+bnr++p0yN90QEncLQTHj82gkWmjZNwP2/DV7mW9B583kLR0qERtFMKb9KVas:SMrmy903T9BEyQFp9GYcljfXTrsK/

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1