Extracted

• • Target

    fedb0713cdb73c4fa6a0e8f0b.exe

  • Size

    790KB

  • MD5

    fedb0713cdb73c4fa6a0e8f0bf122663

  • SHA1

    e1ed0bfc5b13fe7ca04e017b57efd2a38a81c6b0

  • SHA256

    9854574d6eab5cfb0285efd15734d6c166a3527aa50f801b75726a017993f450

  • SHA512

    9dcecefe5b5333a1be29561254536bbae2b35e6817f5426917fb58847a781d0254eeffbd7de6bbf2e85790d76d7cdd91875758993aac91a7e277df8766e58bfa

  • SSDEEP

    12288:M6Qufv3aRdnQgxh7dVOlU6OA9kJy3xv1fN6wqrAsUYx5obLnEYmtYfm9:M6Q0v382gvd+BOA9Xh36SAx5oEY+ug

  Score

  10^/10

  healerredlinenormdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2