Extracted

• • Target

    cb1d26f7a3e33cf0117b6ae71.exe

  • Size

    529KB

  • MD5

    cb1d26f7a3e33cf0117b6ae71acc5330

  • SHA1

    d658ba5dcf77d1456ef14f467ddfbd0c48135d35

  • SHA256

    cc80c0ff50bc3d408942be684a8ece2344a05e5bf0dd00dad04b58305b99ae77

  • SHA512

    f14902749bf54fc1a9c80c45e078684f7a9e4e5e914c1491aed63b95ae97ac7ca7ce6940b7b5138a10172fa6706fd89077f9e854a9b74501fbadeee4c196c7d0

  • SSDEEP

    12288:9UwpfvEaRdnQg3hG9dfx+PzQC8iWAVGTr:9UwFvE82g3hG7s7boTr

  Score

  10^/10

  healerredlinefuroddropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2