Extracted

Extracted

• • Target

    e389d68418c05efa12ac01d756ce3820485da9d47c7352f0f63b1d0471a90c31

  • Size

    712KB

  • MD5

    b7c18471bcd123448148a308f916b5b5

  • SHA1

    e514befe589a4e8ee30ce3afb59e94516cebd6b2

  • SHA256

    e389d68418c05efa12ac01d756ce3820485da9d47c7352f0f63b1d0471a90c31

  • SHA512

    9802db795d9c2a8d19b0ae1a944b01ee1caea4408f3687f730f8963e31e89e6945890392c276d962efdb35f6e598fbfec3c44425251a98d6a6a68fd82e46a6b8

  • SSDEEP

    12288:YMrvy90KZ0FvccImhJ0Jav8ZGIrMPZxo2G3Sq/8aNaADNy:XymvccXJ00v8ZNgPZOf3h91Jy

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1