Extracted

• • Target

    bfc9dc1a7fae0fd262d25ccb67c21ba1de11a323a69065dc814c178b7598a21f

  • Size

    1.0MB

  • MD5

    9fdc2ac20f02a470fd5ccf8827f28db9

  • SHA1

    b95d76bf1b0953b3e53bd4b0970f39502e468a83

  • SHA256

    bfc9dc1a7fae0fd262d25ccb67c21ba1de11a323a69065dc814c178b7598a21f

  • SHA512

    32c059ce309598ee8134d6073068b7ac22a3958ca8dcbecf69d2e5e133dcf3ea0f9c62aaa81bee00134e4601f4ce0d7c5a0b480f29c330bee335d48bcac3cc50

  • SSDEEP

    24576:NyOamX/qFcBxI9awPDBR4vHhPj4PgAQp2tEOaR:owXmVRMHJj4ovRh

  Score

  10^/10

  healerredlinemashadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1