Extracted

• • Target

    884a3f1f1c414b422df6746de596e6782d6340f9c7e7deb84703bb1b8183099d

  • Size

    389KB

  • MD5

    3fada42e970aed015cdda366c2240171

  • SHA1

    2c3be56cfa96a0767b1248a545fbde71ca806a9f

  • SHA256

    884a3f1f1c414b422df6746de596e6782d6340f9c7e7deb84703bb1b8183099d

  • SHA512

    ac54f8fd804a4db94bee977e8364c3491dfe8edf1b620ca3844f0ab2ed90775f27dedbe03a7c2824a137ca9724c9111c6eb553125e3fc34334e77e3d0cbb2d16

  • SSDEEP

    12288:sMr3y90R0YPVFX5+FuCNJr6aOHfHJUCPjk8aH7:jya0sVFp+ZNUaYJB0H7

  Score

  10^/10

  healerredlinenasadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1