Extracted

• • Target

    35c9633557453a246e230eaecf89ee1ed9b9cb8c64130d2ac3153b26be42f91c

  • Size

    1.3MB

  • MD5

    2f5d8811e543173d4a2644cdd0d7072e

  • SHA1

    127704780f8f46cdf69a92e68d444a17520f1ec4

  • SHA256

    35c9633557453a246e230eaecf89ee1ed9b9cb8c64130d2ac3153b26be42f91c

  • SHA512

    6952b3062c462410fa348bdf52312be39f22127f24f1b02d6f2628e32a8b8d95f15be08a24e19d8440b9d62b83017cbbc120d4f4f73505028721776ca9ddd1c5

  • SSDEEP

    24576:twpa5/kzxL9tzhgbkQAcIG/QKfSiXwjzWmku1mas0EcQ16cn1EzZOs:H5/kzYhAhmVXjmkxe9QRnfs

  Score

  10^/10

  healerredlinevashadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2