Extracted

Extracted

• • Target

    205e77ff9406f3f51f7549d5e3575895f882bfd1c6bd15920f6e33419ce9db9c

  • Size

    1.1MB

  • MD5

    27aaf21e965b0839487460b09735c4ba

  • SHA1

    8c43cb4df8e761f711e53fa367f33c027794aa1f

  • SHA256

    205e77ff9406f3f51f7549d5e3575895f882bfd1c6bd15920f6e33419ce9db9c

  • SHA512

    6a4a33fa5d102c9da60cf2b22dce0e1505b8f2100ae3ed5bea0b22779afd1bdc5287a6056368aad29bf6dcdb89c8c647a7dbcef3cd6d8c50f9ad3fb86483231a

  • SSDEEP

    24576:CypwFbixRJEVzX/mmpUpvw7L6eI6trrzp9e6pjv4EOulVsjeUWIaOU:pqkJIzX/TapvwL6entrrzpA67fsjpa

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1