Extracted

Extracted

• • Target

    d10f0c7ac04ded521d8cda803e63e46f14c54291919fc16bd8438065485d7701

  • Size

    852KB

  • MD5

    34afa798007e961394a50f2c16a53727

  • SHA1

    f406b0c999e32a3c83667a9a37556b4f9100744e

  • SHA256

    d10f0c7ac04ded521d8cda803e63e46f14c54291919fc16bd8438065485d7701

  • SHA512

    9d0307b2f398c2c95cbaafc78ab58690f9fa563427aea5733c4db7c7360e27b4f8d163d77346ca588756e0e67d0049b25baee4f3caa960f9e57390b51055adde

  • SSDEEP

    12288:YMrgy90IXOAdh0zk+bGBJZnH3PJDXUCBf9rxCRnU3VE6MDOq4CkyF+YLvG8BsT5:4ypXOGb+b4H/ysYOMXf+mA9

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1