Extracted

• • Target

    dbe22a4274d202e97148ac13d817e66faadc94335373b71957f4554c567eb21a

  • Size

    819KB

  • MD5

    0046eaf045fd21f327619a307f19776a

  • SHA1

    08d6f44321c23f442b164ada6a0eb5d3d26fb46e

  • SHA256

    dbe22a4274d202e97148ac13d817e66faadc94335373b71957f4554c567eb21a

  • SHA512

    e51181b29b948498bb8bfc2d85294ded9c1bfdba653c144eef46179ebf7de119b83d7dc0e6bc5a660d22e0030435a291aae1769d86e97c7c7f2c319dbdd08ed2

  • SSDEEP

    24576:Ayti4J8ySs7lFWTUAIa9/w/g8yiE1pZeKvnrQ:Ht627lFWZ9Og881p3n

  Score

  10^/10

  healerredlinesrutadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1