Extracted

• • Target

    286d94291a196d527d605b3e927215e8ae89eba3c7b4c5fb3fad54aebf9ba67f

  • Size

    714KB

  • MD5

    c4d7e7d1b30f4b0ce45de99d6654aab3

  • SHA1

    d91e7fdd452b538c41c41d11bc02f1a3676e5638

  • SHA256

    286d94291a196d527d605b3e927215e8ae89eba3c7b4c5fb3fad54aebf9ba67f

  • SHA512

    4bfacfb16aeda5ce6f909c102da0764c5c7952b5bdb378324812ff306adf39f43c5a6cd8e78900826e494d15c9d6754ae2459058b90fce524b00914226383eec

  • SSDEEP

    12288:cMrJy90mBlx3gGyKBSicnFhSQdqI1AluQfb7adbNKf+rSlfam9T6R8SR2TJ/obU:ty5lx/yyASQdxmWd5rSRfT6RNct/oo

  Score

  10^/10

  healerredlinelangdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1