Extracted

• • Target

    a5c7f89f6956e8121ed83c06f5d04d2c5a2f7c470448a3f0b72ed752b2b5cec3

  • Size

    930KB

  • MD5

    e5adb53381562c13751bc596ca473633

  • SHA1

    3e6981b6e30b9d1dc32073b2adef7c38bb583615

  • SHA256

    a5c7f89f6956e8121ed83c06f5d04d2c5a2f7c470448a3f0b72ed752b2b5cec3

  • SHA512

    f4fed1910cacd0285d406ef664c5c47c095a0ced6c0e1126369f2de5295310e2f870e024c1456981206654027671f8d4ebead8dbcfef728a870fb4755698fc02

  • SSDEEP

    24576:xyuCGPd9z0OYppBp90538PCUlpI8q+7GJQ2T:kuCGPd9zKdH05cDZn7kQ2

  Score

  10^/10

  healerredlinenravadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1