Extracted

• • Target

    cc015e6e2a3d9e5b39c6cf5f110e060829b26a3f48b190682d16ef221cca1a0c

  • Size

    504KB

  • MD5

    088f8335b9c7f31a7ec17cb8be4b6dbb

  • SHA1

    fc6aecd0d39c055a6b94e387e366c5d26f10bb31

  • SHA256

    cc015e6e2a3d9e5b39c6cf5f110e060829b26a3f48b190682d16ef221cca1a0c

  • SHA512

    d3962af4ebe4b8438fd8ac8118eba32506540c942f46d15c5246267fb5ebce0cb5c8ff697a0b0a8688209e1487c01543328d9929734aaff09966c97891a7be72

  • SSDEEP

    12288:fMrXy90eMqrp/5xQ6CZgizyP5fy0SyTrz6gXiqUQw23IdwxtAP:0yX9rza6QnyP5fy0jrTi/QrfK

  Score

  10^/10

  healerredlinemesondropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1