Extracted

Extracted

• • Target

    90828342ef5951e31bbe745a2ebd89dfeab4209d5bbadb7094cf399eda50a554

  • Size

    811KB

  • MD5

    4de5051dd0d81c7fcc20683a193b83b1

  • SHA1

    b4900821cc258eed86c172303d852e9cff290a01

  • SHA256

    90828342ef5951e31bbe745a2ebd89dfeab4209d5bbadb7094cf399eda50a554

  • SHA512

    130cfc6bd14b6f93954a5f4079116a2fb9f4f97590d5014ca8a56add4767e528abf9d0420053c2dcef8acb1330eed479cb28b0887aaf6b7c7d9ac7c0c92d0740

  • SSDEEP

    12288:uy90vbZx1AaagxkNamvKEDk6vGqg2BoNE6uvLzRsTdv5:uy8DmaaxNryEDZwNEpH6

  Score

  10^/10

  healerredlinedarkgenadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1