Extracted

Extracted

• • Target

    4d55526dc23611051cf06d2b5f972c9d64c9f4b6058da0604f27e224624f5f50

  • Size

    850KB

  • MD5

    384dfd28131c495f106317902c5f8173

  • SHA1

    de3db0f49ade2115114e2eb26c8c3f815dbdac4a

  • SHA256

    4d55526dc23611051cf06d2b5f972c9d64c9f4b6058da0604f27e224624f5f50

  • SHA512

    9861d3fa7f1baaf67fdd127cd6a8cf5e1d735073e30e1c8de4c25a0fe7a270d45f1b6273e397fc5a339b32297023604498563a46e56c230cb0976bc697c7e75e

  • SSDEEP

    12288:cMrsy90Y/cwyVPM2AMimr+HayI4m77S/ItZ8+quLtIOfYwQvZ2IeD6qvISnpKEOP:IyyhhL+bW7wAi+RZQwC1KoFKW

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1