Extracted

• • Target

    6e15c0105c279ff20c9c84fdb0c3997e08cc6e60eab47c3cb3da8499159db054

  • Size

    1.3MB

  • MD5

    df69165c0d54694e4c5899676359524c

  • SHA1

    28acd35d187039fc5ea49b80b324dc01b87f5160

  • SHA256

    6e15c0105c279ff20c9c84fdb0c3997e08cc6e60eab47c3cb3da8499159db054

  • SHA512

    e09c13caf502d2b3dd4c8b22c8c3d369b6d874354c9406757a3a244d9939f81988f2ee678ce08adce51f3931a94d59381488e03b60671e01d76a650ecccaef99

  • SSDEEP

    24576:F09n9p2dg5HnTMXbhxutzjknGZnR+cGp7hnbdHdNrQ:F093225HQX1xutRnGHB3Q

  Score

  10^/10

  healerredlineblackdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1