Extracted

Extracted

• • Target

    cf60b7d2fa82e6176ac35a2477545f6b7e8b36b27a683091dfa7b0912b15d438

  • Size

    671KB

  • MD5

    97599e8f84c93023ce5cb4541cc9749a

  • SHA1

    949aa0c581600d86201d26ce79db2c487bd572bd

  • SHA256

    cf60b7d2fa82e6176ac35a2477545f6b7e8b36b27a683091dfa7b0912b15d438

  • SHA512

    fed82ccc79b179c2025d1661a1783281171f4920c52e43c54e534a2454e07072b5220d8285c89d8a41d59ad97728d250acc51d3825bfda1a9e9e42c5f7437bd6

  • SSDEEP

    12288:8MrYy90l3oDrMzB9fJDBFfVqyNBaLYTcljRTo+qjUgn/1SSNtU:8ygIMzFDBfqGj8jRpIUooSLU

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1