Extracted

• • Target

    1cef1149856544efee651a561a8aa266fee0265442fe7d2d303a83fcf44b23f9

  • Size

    1.2MB

  • MD5

    859072b38a096eb6c51b0b73981368f7

  • SHA1

    e44c41b15723bff47f78ef4ddee1aba6856cde2a

  • SHA256

    1cef1149856544efee651a561a8aa266fee0265442fe7d2d303a83fcf44b23f9

  • SHA512

    c1c04d801be2f8b85e2756910121b7472a1ebc0391d656d863ea5d69c62714ffaa0719b2b62b276fddc478a66fd125d312f4e526ebd50cd16501994ee829d0cb

  • SSDEEP

    24576:89q+Vg6maQcellE/XyQNabL1NbpgkOs3pNvjPnASXju58yDMyO5LLvG:Qq+VBalRYedKkOs33XXju5zMyOtLvG

  Score

  10^/10

  healerredlinepetindropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2