Extracted

• • Target

    0f44ce948fb795200e49a385da663fdf.exe

  • Size

    828KB

  • MD5

    0f44ce948fb795200e49a385da663fdf

  • SHA1

    9d9efbc7a363f5ebda0e8b70dca669712aa20c34

  • SHA256

    b27a6d841380f2dc3e011b8dc60fd30524898675d5fe3f0070d594330b3ea5f4

  • SHA512

    cb569b3761c46c7f5bb6108e95d365de02b91f31e0c90acf008ac4c56d58e79765ca9099196a6d205c043dc25c82e79c73eed469403d4654494b613474373d57

  • SSDEEP

    24576:gyvFGW10ijG8t9hqB285b/4wW/vbBWIvdM3:ntGW6L8tnq0Mi/jBtvy

  Score

  10^/10

  healerredlinerotadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2