Extracted

• • Target

    x2187432.exe

  • Size

    767KB

  • MD5

    ae57bf787472df63812c94000b30e5e3

  • SHA1

    815744b59c8c14100fa17a50be7d010f6b51675d

  • SHA256

    ff5bff453148333bc10d200e02ff7d9848690214fc6b56a5ded05c517ec6b58a

  • SHA512

    7b046d0348cdd2ffbfbee7ba088a8f91373c80cf9e6b99c11ac2db2ebfd124120c6a589a2746a949038ca61b7f5ae55b8aeb8c365825d0d78218f0fba744d6a9

  • SSDEEP

    12288:1Mr/y90ib6+7ZCYjY8zCdkvvahvVnubBoBK4TsfWF3bMUhiBUL5glXYR5KaRZwPg:2y5xdCqg+vOubB+Kfs3QUEBUFg2TRZwY

  Score

  10^/10

  healerredlineblackdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2