Extracted

Extracted

• • Target

    d68eb76f688b8f8c628de8bf88f1e387cc8894045a06223eaeedba2f0522fc36

  • Size

    850KB

  • MD5

    2b09455a317c453c0760e2c057923981

  • SHA1

    ad56468369e4578d8ba35024b4a63985b592ae3a

  • SHA256

    d68eb76f688b8f8c628de8bf88f1e387cc8894045a06223eaeedba2f0522fc36

  • SHA512

    4ed52997660a6f3bef89984b03a8c3c12256afaeb9627b3cb82ef85fd65c5bdac9f47240dc78496a2ce1d3f6124a8f259e105cff5823ddb50c2bbad9d7ac24bd

  • SSDEEP

    24576:OypEx601a/G+j2UGs2qhLIIZsunwCEzMJz4Ot0Z42:dE+/xA7YLNsGnE0z4t4

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1