Extracted

Extracted

• • Target

    4cbd8a7ebd3eb952243bce4a2d5d130ef6c052265c56094548f9bc54e643a0f1

  • Size

    1.1MB

  • MD5

    72b1ee07193a757430fb3b10d144e3ae

  • SHA1

    2072ba1e248981c7347236048ac94aa10f81093e

  • SHA256

    4cbd8a7ebd3eb952243bce4a2d5d130ef6c052265c56094548f9bc54e643a0f1

  • SHA512

    7229421776b24fb09d63a267c448c5e053a27338edb364c2ab24e528d5991017a53ff1cbfce72d06da80916abc6a2b1d3f44af0fbfafc2823001c4dc02522622

  • SSDEEP

    24576:Dyw+2aCuaDvYudz1u9urk/SzNN+D/XEwP4gbYnF00RawWH:WwTdVkufu9ug/YNNEt7knF06DW

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1