Extracted

Extracted

• • Target

    ad940754bd9a1f3e74ef0ae40152b2d76e18868d8190f799ca70ada0aa2000f2

  • Size

    1.1MB

  • MD5

    a7ac18641bbda34b5d3b23cc92e06442

  • SHA1

    fd1699573075824f6525d050498ee5b77c19f422

  • SHA256

    ad940754bd9a1f3e74ef0ae40152b2d76e18868d8190f799ca70ada0aa2000f2

  • SHA512

    04d28105dcfc466b2bec3ffff34e0bc16c39ce09a98e430c7e11827d13fb3640de868eade287f8892ac60a7d4c880aa3e32031139b9dcd3462155f40435155df

  • SSDEEP

    12288:7MrOy90D/BHkLbJCCOGQ4t8v9I98sFj6hdkzdVOqNyG0q+VSWyN93yAT8cwlftqP:Zy6/BHkKrbv6iejKdq5+N8hGHYmuz5

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1