Extracted

• • Target

    7e420dfd5377fc7cf6823892af55e7a3a061aac8b7a6d4c4d89550b64775cea2

  • Size

    929KB

  • MD5

    ec03a91dd720ed039081d38588e0e220

  • SHA1

    48fb640e7a5e74239267ca30f6428eab5f5c9f14

  • SHA256

    7e420dfd5377fc7cf6823892af55e7a3a061aac8b7a6d4c4d89550b64775cea2

  • SHA512

    f84c1c92d4312c6d4a6f158fb919d0e38d5f2d1f4b1600746cf2036f4a4f89e3372c65d4155dccc903890c7c6b09c0ddf92b943bccf19884016b2a23af2559e2

  • SSDEEP

    12288:lMrKy90T6P4TTYvQGFaxzO3b42tMBpfeDlzX0V94N8KIijgr630+cWfdaGzuewUy:bygk5IGuzobHtTaV91Ogrw0t5NFft

  Score

  10^/10

  healerredlinerotadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1