Extracted

• • Target

    2c53b4b8fc2d91777c20ede23806a350522bce02eaba75d566cf1d9c14878c09

  • Size

    895KB

  • MD5

    bf0629bd2eae4e04e493b7f48cbbfc58

  • SHA1

    7df6fbed4e373c88d355c7f05d3670ba692ba829

  • SHA256

    2c53b4b8fc2d91777c20ede23806a350522bce02eaba75d566cf1d9c14878c09

  • SHA512

    150494cb946d3cc234fae43ab212d89912d27d648fed2792469fc455fa4f9b4105afa28c0893a30acff10bcd3556833b8574857468d6586f93d0d25fadf698f9

  • SSDEEP

    24576:Ey6xHRARcetrGdqJMIK1UxGAvIMsHMtPSG2:TCxAR7tqbIxijsF

  Score

  10^/10

  healerredlinedarkdiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1