Extracted

• • Target

    b529184a968e187d8e3c1fb1d4133608e61ff7f7e95fc84098679ae5339f907e

  • Size

    389KB

  • MD5

    dc040decb5b2c6d9ecea559a7c5adc75

  • SHA1

    e86cf376c49fb3c5c44ba7a16adbb3fe210621f1

  • SHA256

    b529184a968e187d8e3c1fb1d4133608e61ff7f7e95fc84098679ae5339f907e

  • SHA512

    8a76c94b058a49678440aadb905a60c74b75076d019d8f53098bdfe927e5a6736eef0889be74d489cfaf1cb8648aec3ee9e41590986bce116762423af6de6df0

  • SSDEEP

    6144:Kpy+bnr+ep0yN90QE9ktVd8DkWcnZNbQR59iq/PMGNZleISatV2xPN8n6degk6uz:rMriy90LkHdN6nfzG86IF

  Score

  10^/10

  healerredlinenasadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1