Extracted

Extracted

• • Target

    d3a7966940b83cb9366a3f3f7d365c5a1c7242a2a47184e544be2b22225dd4c9

  • Size

    1.1MB

  • MD5

    e4327f8d8dbb2aa7f5d30a445fb7b723

  • SHA1

    d0bf93930ab3fc9d2f2b1e61eb3061c15acead48

  • SHA256

    d3a7966940b83cb9366a3f3f7d365c5a1c7242a2a47184e544be2b22225dd4c9

  • SHA512

    019818c2c23f03ec9071c16bc114ef68d1b5733cf8f0eca3f3b4d4baec1484a395153d85a281e595e1d55851f21bb4810ec971e47adb802d8459971a9c012fc0

  • SSDEEP

    24576:8ysSE3Qz9uQfEa+UuBqQO4tGbMeLEt95XSiU:rsSEs9u6Ea+qNsUbYt9J

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1