Extracted

• • Target

    file.exe

  • Size

    1.6MB

  • MD5

    7e6d1f2aaa5b2a683cd7e3abf4c1896c

  • SHA1

    6df1a2b736aeaa27b2db548f40a63b796f82f2d2

  • SHA256

    e58b948e947e7b6ee34bece8810f0b4fde7b67a30e2aca4e73fd03d265e5f95d

  • SHA512

    5d7748fb988486e179a8f57b51d4e2240604da979b2301d237a29579a6cff5b541322f4f3b8544b4bea0d5ba41a020b469e6172d8f042b9f590e4ddcb916b562

  • SSDEEP

    24576:3yL7HdZhgJTLrED3oofRwFeeaLRrBHnCW4qfLcmVKAndg0S7WnsEH:CL7HhgFrG46eaLJ1x5DcQKA2H

  Score

  10^/10

  healerredlinemashadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2