Extracted

• • Target

    953317f4b9fe7c635a7e567bc8364004a924201e132d32b4b52e3e8ddc186107

  • Size

    389KB

  • MD5

    8460839d88470abc63cb8b0627566bf9

  • SHA1

    d2d3a870c95135379130e0c8a1a6454dde7eb346

  • SHA256

    953317f4b9fe7c635a7e567bc8364004a924201e132d32b4b52e3e8ddc186107

  • SHA512

    6289d16e5ba5236ee45bfc9eca6b58ed740e7ee0a7c3fc99b6c96b5e7533bf7384121f9166e6f79fdcc17dc20613d3485b510d350be5ad86becc5db842459e84

  • SSDEEP

    6144:K1y+bnr+ep0yN90QEn6DP5m21srlPhkxPb27HSZt8nlzcVF9SF+zrotU0Ky:zMray908Dhm21srlORiY8lvFCU1

  Score

  10^/10

  healerredlinenasadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1