Extracted

• • Target

    0ccdaa4b3990bcf4745acfd0ef34da97e2a8734aaa88d6b9b6bbf6b7750630e1

  • Size

    1.2MB

  • MD5

    52b8c6aca612750f0732e58b42e9db9e

  • SHA1

    2acc3ab9792418c585a67a793db4dd10761e3d95

  • SHA256

    0ccdaa4b3990bcf4745acfd0ef34da97e2a8734aaa88d6b9b6bbf6b7750630e1

  • SHA512

    435c59ce6d85bba3c23820dbc85b5e91059b8f712c8c411889193f5d4a41a56e1685a23bd192fababd0e49f4f075dce5083b26a0e4b0dd917a26c5e6f9265809

  • SSDEEP

    24576:4Zts6DyaTwqfK5ASnIwHnNwVza8gswrbVWNO0Q5055Nv/aSIjfhZ:4ZtsZqf8nIynYOYNO0BlvyNfhZ

  Score

  10^/10

  healerredlinepetindropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2