Extracted

• • Target

    e2e0e65353db80aa3da1aca2fe9337c993b1f7c7d3c0c0e7fbba87b3f9ee719b

  • Size

    829KB

  • MD5

    a623a2ce98687b09744886fb1da80afe

  • SHA1

    f72d739892bc4ec21341c443a285c5b5cae39206

  • SHA256

    e2e0e65353db80aa3da1aca2fe9337c993b1f7c7d3c0c0e7fbba87b3f9ee719b

  • SHA512

    14ffe3e7349ba4d4543d320725cf81e3702aa844e6d7057e6e7450f2ced0d0c43a685165aa3dfdf6957f06fdab770af0866ea9a5a7d2f1641bb0c9c9a90175b6

  • SSDEEP

    24576:NysCK4DOvGGpMHA/B4yUlwxLzvqkvdObvKKFX:oPL6MHAZ4vYFObic

  Score

  10^/10

  healerredlinesrutadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1