Extracted

Extracted

• • Target

    ec4e8930c54eb5e3d8c75e28508ce36f9c5cafc34834260bf9a1d60941953e27

  • Size

    811KB

  • MD5

    edda065ef9b84f7b2972f8fb863b2602

  • SHA1

    c336d21dd0768ad8b2e4fb229f9377bce9101aff

  • SHA256

    ec4e8930c54eb5e3d8c75e28508ce36f9c5cafc34834260bf9a1d60941953e27

  • SHA512

    828bb57513b3857b2634019348e4bc11806f2fbbedc73de980fc1317552df70306cabd7ddb506582454995af86432f104340fbc1877485b2707a52dd407d5dc6

  • SSDEEP

    12288:HMrAy90yvIHHx8EzAjCpTWAOFEcOzpcLfx4Ec7fAz7df1VfBbK2:DyG5pV7cIYp41yJfBbf

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1