Extracted

• • Target

    x8002878.exe

  • Size

    326KB

  • MD5

    d450a74effe247298e76be251e9d20b6

  • SHA1

    2ec5fbbbd9ea9125beb84d456fac275f9dc42adc

  • SHA256

    c22b6ac1147733913380ba7c0f23d9e8802bb8f91b681e416aa5c5a0f942d105

  • SHA512

    1d4d264d1e20603a5d9dccac06c5055b5ec2555f3d6d390b4bd066a45ff23ede0ea15df9eec5154ac3601c7f28537b4096d703ea294295973e99fbf2b149d678

  • SSDEEP

    6144:K1y+bnr+Fp0yN90QEmnL5C8HqZiuNf0OSbCAVmEDus9CFst:HMr5y90A5OZiuN7oVcsGst

  Score

  10^/10

  healerredlineblackdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2