Extracted

• • Target

    5bda6ef8ff80757552db19d62fad1ff7a5fce6bd9c9a870f17a3a7b7b6a5ca4e.exe

  • Size

    1.0MB

  • MD5

    be45be16fad4076558fd205a0488ea94

  • SHA1

    32391c45d423601da805187a50f7bcfc65f0e665

  • SHA256

    5bda6ef8ff80757552db19d62fad1ff7a5fce6bd9c9a870f17a3a7b7b6a5ca4e

  • SHA512

    d3def8cd19c40ffb0354aee030aafc07b49fb947f5628d5f88ef99ad578df719e256d3801c3ff989a019177c85f9976135b06bd11996ef1d84b27d41342e3722

  • SSDEEP

    24576:Fy1urNNX55bhJo9JwLkOjwQXIxyT5SWehFTqZpY9mSf+cf:gwrNpbhJl6yT56FTqvY9l+

  Score

  10^/10

  healerredlinemashadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2