Extracted

Extracted

• • Target

    349c8b2f1aa564b0c95f2749b54ce14d5239d25b375605d59f82bac1d84acfc2

  • Size

    1.1MB

  • MD5

    39db4949514fca709b6ac15359cecd04

  • SHA1

    c6aababecbde72cac146dacac4af1df81649a0c8

  • SHA256

    349c8b2f1aa564b0c95f2749b54ce14d5239d25b375605d59f82bac1d84acfc2

  • SHA512

    7a6f41e02adc495bfc747a113cbee956951420d2110b5263a89c9731780b12804b8f19911dae4434bd13d0d8e71d2293bd762b4b7b618731bb2e83f6b844d201

  • SSDEEP

    24576:yyEF4+3t96tvhPOy4iTJVgiHXr6vNX+0IEEsK0KlsxjvXwu78:ZED3t96dhPOyTHreNX3rWlezAu7

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1