Extracted

Extracted

• • Target

    6df901064bf967b6ed99894a3f63547fa8480d42e4738cbf40a780757378a2e3

  • Size

    885KB

  • MD5

    5f74e6b28bc1c434806d3d92a11ac62c

  • SHA1

    76ceb0ce681fed7f30c2f79ef0d819ec2b14a965

  • SHA256

    6df901064bf967b6ed99894a3f63547fa8480d42e4738cbf40a780757378a2e3

  • SHA512

    7941be863a41f4f3fc68b8898ed56f7c3031596f11b8c7aae94a2b89056b51283e7276ae927030d8a51f66686e7de6a4203607de3a852bb6deb6b9f227b1d922

  • SSDEEP

    24576:CyFJp/godzzWocEkHMmj/80d+ot2CWCvaJw:pRbz8Me/N4ojWCvU

  Score

  10^/10

  healerredlinedizaladadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1