Extracted

Extracted

• • Target

    467af0108af9c89ad38f3a6fc2594edaa43043516805a927e7223be720a4d972

  • Size

    810KB

  • MD5

    e12e2e825bbd118241437e6be000446f

  • SHA1

    4fb463b406bb7d0d4e9ab9dba822d1a2cd12595a

  • SHA256

    467af0108af9c89ad38f3a6fc2594edaa43043516805a927e7223be720a4d972

  • SHA512

    dfb68e95a97e2e96d34630edb8163e4b8ed1f94697d6c74ae81b2dff33a789c10b6e35405bf720c3ce73c8f0a28a796bbf6f33a41ba27dd954630d6d30f2fd51

  • SSDEEP

    12288:3MrKy9015LPUCY3lUyJoRdulnVLhdAQCcF4D+5/yWRDM:VyaIUyyRIlPdeD+7RDM

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1