Extracted

Extracted

• • Target

    64a9a3c471759f0ff2deb2630dc05a85ee521cdcfd54c8a9a40a15803374e341

  • Size

    713KB

  • MD5

    07973d375ada0d253546d08b50a2204f

  • SHA1

    db174bf1791d7c3b04f824ea3b2a7d4723e15c0f

  • SHA256

    64a9a3c471759f0ff2deb2630dc05a85ee521cdcfd54c8a9a40a15803374e341

  • SHA512

    e27dfda5a1b591709fe61bc89fa8c22d383713bfc4ece2fde3fff1f209419eb002ca663e60558747a7212d0dc5fb68e148ca5c6b5b474194a00489047b8241d1

  • SSDEEP

    12288:7Mr3y90nAQVSQ61Zsa6St69z3sUtDpBwFi48DYN4caXFp42VI4lS:gyNQhJSAz88fw8Gkp41+S

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1