Extracted

• • Target

    2a51c7c55ea7ab9f2ba4ea125c91cad150cc20c25b2fb891e56708ffad766d16

  • Size

    505KB

  • MD5

    52016017a0a489912f6eee291be2efb0

  • SHA1

    56443942efc5f1fb1b18d57c479cb4a45fca3968

  • SHA256

    2a51c7c55ea7ab9f2ba4ea125c91cad150cc20c25b2fb891e56708ffad766d16

  • SHA512

    39aca15adbc2ceb431e9de609460610226d1f16e0aadc10a50994caa72f1460c29dcc9d28161cd3c2559a8b287f426f82d2e82cd5965ca9799576604823436ed

  • SSDEEP

    12288:4Mrfy90ndiOabo5geyAH3TK+KnE1TBhSV62b/pS9+:nyAc5b2rXTKpE3h061+

  Score

  10^/10

  healerredlinedavadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1