Extracted

• • Target

    e78da6221b0753644a09316c5c8fecb2a14e0bae2d9a38d8ac497573a952ceb4

  • Size

    768KB

  • MD5

    c2d280d5dd66c8a297f2e19713ea6a90

  • SHA1

    0d4d56a897012f7b28a476a7b839bf7f3d386c76

  • SHA256

    e78da6221b0753644a09316c5c8fecb2a14e0bae2d9a38d8ac497573a952ceb4

  • SHA512

    7d8cec302af3e79d9d348bff17d79f92bc0e101da10c55784f2300a676286ff946bb8eeb5ebf481cb20e765e719bc31cf9957189cd5569c5f7e737ce6f12040d

  • SSDEEP

    12288:QMr5y90zM4qBXurPsrbi67bRbx7sD/Hd4cCMUKrcprko/VSXJTZrTIKZqF9Fmj:5yQmZuraLbRRsDl4cd1i3UK9e

  Score

  10^/10

  healerredlineladadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1