Extracted

Extracted

• • Target

    cfe093f7607e7c2399dfe9f2619d98e1ca8453b9e317e6179c113334d8855791

  • Size

    810KB

  • MD5

    0e90aaff77dce8f5fef55e84e7388e96

  • SHA1

    9eb41df9cc058e14654d9245db5ed0bf2b8da0ef

  • SHA256

    cfe093f7607e7c2399dfe9f2619d98e1ca8453b9e317e6179c113334d8855791

  • SHA512

    39c98311b6aefa499d97df383fcb3410140b8995eab62d5d3174854e10577dda0b9876f239ee9d766f40fa1d6e3f689b575cc667c84e63f1627a42039fa76e41

  • SSDEEP

    12288:sy90ggan8EQy+gRikxiB5+uP6BKbpaFIvcJPFow06kvr9VQMIAJG:sy5ga8Ry+uCL+uis7w0JhSM/G

  Score

  10^/10

  healerredlinedarkgenadiscoverydropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1