Extracted

Extracted

• • Target

    2e7f74a8f2a6aa3cf4b94892755c50bfaa39fb4d09b4b5e743de51ae2f50626f

  • Size

    671KB

  • MD5

    e0aa87c562cc1161e3485f9ca34887d4

  • SHA1

    e6287a2b5c54f48fa3d4a5c00d3c5aae944cd373

  • SHA256

    2e7f74a8f2a6aa3cf4b94892755c50bfaa39fb4d09b4b5e743de51ae2f50626f

  • SHA512

    70934bb653e3aba3c2d57ac1a2ae12db84b55a23d248853a1a1fb0ae3d2d17254ec14d964bd5eb5dfa32e62cd8c512aa975951aa5c34afd158a326deda2c7da8

  • SSDEEP

    12288:aMr4y90b0sNoeTs+m0oiijmve3MRrnLRwcMQafKywTI:uypKjTs+m8vk2NaQav

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1